Description
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-21
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw allows an attacker to inject arbitrary shell commands via the timestr argument to the /cgi-bin/mbox-config?method=SET&section=ntp_timezone endpoint. This leads to remote command execution, giving the attacker full control over the device. The weakness is a classic command injection vulnerability (CWE-77) arising from improper validation of user input (CWE-74). The publicly released exploit demonstrates the feasibility of this attack.

Affected Systems

The vulnerability affects devices running Comfast CF‑N1‑S firmware version 2.6.0.1. No other versions are listed, so only that build is known to be susceptible.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. The EPSS score is not available, but the exploit has already been released and can be launched remotely, likely over HTTP. The vulnerability is not listed in the CISA KEV catalog, yet its high severity and public exploit make it a significant risk to any network that exposes the device to the Internet or an untrusted internal network.

Generated by OpenCVE AI on August 21, 2026 at 11:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s updated firmware that removes the command injection flaw on the /cgi-bin/mbox-config?method=SET&section=ntp_timezone interface.
  • Restrict or block external access to that endpoint or the device’s management interface using a firewall or access control list so that only trusted administrators can reach it.
  • Implement network segmentation and least‑privilege access controls so that only necessary personnel can reach the affected device, and monitor logs for anomalous command execution attempts.

Generated by OpenCVE AI on August 21, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title Comfast CF-N1-S mbox-config system command injection
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-21T10:15:08.099Z

Reserved: 2026-08-21T05:31:50.847Z

Link: CVE-2026-77683

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-21T11:17:06.457

Modified: 2026-08-21T11:17:06.457

Link: CVE-2026-77683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T11:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')