A stack-based buffer overflow exists in the web management component of Comfast CF‑N1‑S, specifically in the function handling the "/cgi-bin/mbox‑config?method=SET&section=ntp_timezone" endpoint. Manipulating the arguments timestr or ntp_client_enabled can corrupt the stack. The overflow could allow an attacker to execute arbitrary code on the device, which is a severe impact as it gives the attacker full control over the system. Based on the description, it is inferred that the overflow is exploitable remotely, and the public exploit suggests it can be used in real-world attacks.

The vulnerability is confirmed in Comfast CF‑N1‑S firmware 2.6.0.1. CPE data indicate that the model CF‑N1‑S is affected; the CVE description does not list any fixed versions, so other firmware releases may remain vulnerable until an official patch is applied.

The CVSS score of 9.4 marks it as critical. EPSS information is not available, but the exploit has been published and is stated to be usable, implying a non‑negligible exploitation probability. The issue is not listed in the CISA KEV catalog, yet its high severity and remote nature mean that attackers could target the device widely. There are no known mitigations from the vendor, so the risk remains until a fix is deployed. The likely attack vector is over the network, targeting the device’s web management interface, which is commonly exposed to administrators or in some cases to the internet.