Description

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T02:17:30.757Z",
  "pubdate": "2026-08-18T02:17:30.757Z",
  "executiveSummary": "An OS command injection vulnerability has been identified in the COMFAST CF-N1-S router running firmware version 2.6.0.1. The flaw exists within the CGI Interface, specifically inside the /cgi-bin/mbox-config?method=SET&section=ptest_ssid endpoint, which invokes the vulnerable function sub_44B438.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands with the privileges of the underlying web server or application process by manipulating the ssid argument.\nSuccessful exploitation of this issue can lead to a complete compromise of the affected device, allowing malicious actors to intercept traffic, pivot into internal network segments, or deploy persistent malware.\nGiven that public exploit details have been published and remote exploitation is feasible, the risk level associated with this vulnerability is critical. Immediate remediation or network-level isolation is strongly recommended.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the CGI Interface of the COMFAST CF-N1-S 2.6.0.1 firmware. The affected component processes HTTP requests sent to the URI path /cgi-bin/mbox-config with the query parameters method=SET and section=ptest_ssid.\nUpon receiving the request, the binary passes the user-supplied input from the ssid argument directly into the function sub_44B438 without adequate sanitization, validation, or escaping.\nThe root cause of the vulnerability stems from insecure inter-process communication or direct shell execution routines, such as system(), popen(), or equivalent C library calls, where concatenated user input is evaluated as a system command.\nThe step-by-step attack flow proceeds as follows: First, an external attacker crafts an HTTP request targeting the vulnerable /cgi-bin/mbox-config endpoint. Second, the attacker appends malicious OS command separators (such as semicolons, pipe characters, or backticks) followed by arbitrary commands to the ssid parameter value. Third, the HTTP daemon routes the request to the CGI binary, executing the sub_44B438 function. Fourth, the function processes the unsanitized ssid string and passes it to the underlying operating system shell. Finally, the shell executes the injected commands with the execution context and privileges of the web application process.\nNetwork exposure is remote, as the CGI interface is typically accessible over the network interface of the router. Exploitation does not require prior authentication or specialized administrative privileges, significantly lowering the attack barrier.\nPost-exploitation impact includes full system compromise, unauthorized execution of administrative utilities, modification of device configuration parameters, and potential utilization of the embedded device as a pivot point for lateral movement within the local area network."
}