Description

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-19T03:16:53.077Z",
  "pubdate": "2026-08-19T03:16:53.077Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Comfast CF-N1-S router firmware version 2.6.0.1. The flaw resides within the URI Parameter Parsing component, specifically inside the get_para_from_uri function handling requests to the /cgi-bin/mbox-config endpoint. This vulnerability allows remote unauthenticated attackers to manipulate the width or height arguments supplied via the URI, resulting in a stack-based buffer overflow condition. Successful exploitation of this vulnerability can lead to arbitrary code execution, denial of service, or complete system compromise, posing severe risk implications for network infrastructure utilizing the affected product. The attack vector is fully remote and does not require prior authentication or privileged access, relying solely on network accessibility to the targeted device's web administration interface.",
  "technicalDetails": "The vulnerability stems from unsafe memory handling within the URI Parameter Parsing component of Comfast CF-N1-S version 2.6.0.1. Specifically, the function get_para_from_uri, located in the binary processing requests for the /cgi-bin/mbox-config endpoint, fails to properly validate or bound-check the length of input parameters supplied through HTTP GET requests.\nThe root cause is a classic stack-based buffer overflow where user-supplied input corresponding to the width or height arguments is copied into a fixed-size stack buffer without adequate length verification. When an attacker submits an overlong string via these URI parameters, the input exceeds the boundaries of the allocated stack buffer, overwriting adjacent stack memory, including saved frame pointers and return addresses.\nThe attack flow initiates when a remote attacker crafts a malicious HTTP GET request targeting the /cgi-bin/mbox-config URI. The request incorporates a specially crafted, oversized payload within the width or height query parameters. Upon receipt, the web server passes the URI string to the get_para_from_uri function for parsing. As the function extracts and copies the parameter values into memory, the lack of boundary enforcement triggers the buffer overflow.\nRegarding network exposure, the vulnerable endpoint is accessible over the network, allowing remote attackers to initiate exploitation without authentication or privilege requirements. The payload behavior involves corrupting the execution stack control data, which can redirect execution flow to attacker-supplied shellcode or cause an abrupt termination of the process, resulting in a denial of service. Post-exploitation impact includes full control over the underlying operating system environment of the affected Comfast CF-N1-S device, enabling persistent access, lateral movement within the local network, or interception of network traffic."
}