Description

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-20T16:18:31.580Z",
  "pubdate": "2026-08-20T16:18:31.580Z",
  "executiveSummary": "An unauthenticated remote command injection vulnerability has been identified in the Comfast CF-N1-S router running firmware version 2.6.0.1. The security flaw specifically resides within the CGI binary handling the mbox-config endpoint. By supplying a maliciously crafted payload within the sn parameter during a SET method request targeting the ptest_sn section, an attacker can manipulate underlying system commands executed by the device.\nThe vulnerability stems from unsafe string formatting operations passing unfiltered user-supplied input directly to execution sinks. Successful exploitation allows remote attackers to achieve arbitrary command execution with the privileges of the underlying web server or root user, potentially leading to total compromise of the affected device, network pivoting, and persistent unauthorized access. Given that public exploit material is available and the attack vector is network-accessible, the risk level associated with this vulnerability is severe.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw affecting the Comfast CF-N1-S firmware version 2.6.0.1. The vulnerable component is the CGI script accessible via the HTTP path /cgi-bin/mbox-config?method=SET&section=ptest_sn. Specifically, the flaw exists within the implementation of the sprintf function, which is utilized to construct a system command string using parameters supplied by the HTTP request.\nThe root cause of the vulnerability is the lack of proper input validation, sanitization, and escaping of the sn parameter prior to incorporating it into the string formatting routine. When an attacker sends an HTTP request with a specially crafted sn argument containing shell metacharacters or command separators (such as semicolons, pipes, or backticks), the sprintf function formats the input directly into a command execution buffer without restriction.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker crafts an HTTP GET or POST request directed at the /cgi-bin/mbox-config endpoint, explicitly setting the query parameters method=SET and section=ptest_sn. Second, the attacker appends malicious payload syntax to the sn parameter. Third, the affected CGI binary parses the request and passes the tainted sn value into the vulnerable sprintf function to construct an internal system command string. Fourth, the resulting formatted string is passed to an execution sink (such as system() or popen()), causing the operating system to execute the attacker's injected shell commands.\nDue to the network exposure of the web management interface, no prior authentication or specialized privileges are required to launch this attack. The payload behavior executes immediately upon successful processing of the request, granting the attacker arbitrary command execution capabilities. Post-exploitation impact includes unauthorized modification of device configurations, denial of service, deployment of malicious binaries, and potential unauthorized access to internal network resources connected to the compromised device."
}