Description
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-20
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A stack‑based buffer overflow exists in the get_css_path_from_uri function of the Web Management Interface on Comfast CF‑N1‑S devices. The flaw is triggered by manipulating an input parameter, and the overflow can be exploited from a remote host, potentially allowing an attacker to execute arbitrary code on the appliance.

Affected Systems

The vulnerability affects the Comfast CF‑N1‑S model running firmware 2.6.0.1. Only devices with that exact firmware revision are known to be vulnerable.

Risk and Exploitability

The CVSS score is 10, indicating a critical severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalogue, but the exploit has been publicly disclosed and can be used by an attacker who can reach the device’s management interface. If exploited, the attacker could gain full control over the device and potentially compromise the associated network.

Generated by OpenCVE AI on September 20, 2026 at 12:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Comfast firmware update that fixes the get_css_path_from_uri stack overflow (addresses CWE‑119 and CWE‑121). Apply the vendor‑issued patch following standard testing procedures.
  • If a patch is not yet available, restrict access to the Web Management Interface by configuring firewall rules and network segmentation, allowing only trusted IP addresses to reach the administration port.
  • Enable comprehensive logging of remote web management traffic and actively monitor for abnormal requests to /cgi-bin/mbox-config; set up alerting for repeated failed attempts or unusually large input values that may indicate an active overflow attempt.

Generated by OpenCVE AI on September 20, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T11:30:08.209Z

Reserved: 2026-09-19T14:51:07.349Z

Link: CVE-2026-94003

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T12:17:05.403

Modified: 2026-09-20T12:17:05.403

Link: CVE-2026-94003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T13:00:11Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow