Description

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-17T03:16:50.333Z",
  "pubdate": "2026-08-17T03:16:50.333Z",
  "executiveSummary": "A critical security vulnerability has been identified in the COMFAST CF-N1-S router running firmware version 2.6.0.1. The flaw is classified as a command injection vulnerability, allowing an unauthenticated remote attacker to execute arbitrary system commands on the underlying operating system.\nThe vulnerability resides in the Common Gateway Interface binary handling requests at the endpoint /cgi-bin/mbox-config?method=SET&section=ptest_macaddress, specifically within the vulnerable function sub_44A968. Improper sanitization and validation of the macaddress parameter permit malicious input to be directly concatenated or passed into a system shell execution context.\nSuccessful exploitation of this vulnerability results in full remote code execution with the privileges of the web server or underlying administrative context, severely compromising the confidentiality, integrity, and availability of the affected device and potentially exposing connected local networks.\nThe attack can be launched remotely over the network without requiring prior authentication or user interaction, significantly lowering the barrier to entry for threat actors. Publicly available exploit material increases the likelihood of active exploitation in the wild.\nThe vendor was notified of this security issue prior to public disclosure but failed to provide a response or a patch, leaving deployed systems exposed unless compensating controls are applied.",
  "technicalDetails": "The vulnerability is an OS command injection flaw affecting the COMFAST CF-N1-S router firmware version 2.6.0.1. The root cause of the issue stems from the insecure handling of user-supplied input within the CGI application processing configuration requests.\nSpecifically, the attack vector targets the HTTP endpoint /cgi-bin/mbox-config when invoked with the query parameters method=SET and section=ptest_macaddress. Within the binary implementation of this functionality, the function sub_44A968 processes the macaddress argument.\nDuring execution, the function fails to adequately sanitize, filter, or escape special shell metacharacters provided via the macaddress parameter. When the input is subsequently incorporated into an internal operating system command string—such as a system(), popen(), or equivalent execve-style system call—the injected characters are interpreted by the underlying command shell as command separators or operators.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTTP request targeting the /cgi-bin/mbox-config endpoint. Second, the attacker appends OS command injection payloads, utilizing characters such as semicolons, pipe symbols, or backticks, directly into the macaddress parameter value. Third, the web application forwards this unvalidated string to the vulnerable function sub_44A968. Fourth, the binary executes the constructed system command, passing the injected payload directly to the underlying shell.\nBecause the service is exposed via the network gateway and the endpoint processes requests remotely, network exposure is direct. The vulnerability can be exploited remotely over HTTP/HTTPS protocols without requiring authentication or prior system access.\nThe post-exploitation impact includes complete device compromise. An attacker can execute arbitrary system binaries, read sensitive configuration files, modify routing tables, establish persistent backdoors, or pivot further into the internal local area network connected to the compromised COMFAST CF-N1-S device."
}