Description

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-20T17:19:49.413Z",
  "pubdate": "2026-08-20T17:19:49.413Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Comfast CF-N1-S router running firmware version 2.6.0.1. The flaw is categorized as a stack-based buffer overflow affecting the SSID Configuration component, specifically within the endpoint /cgi-bin/mbox-config?method=SET&section=ptest_ssid. This vulnerability stems from improper handling of the ssid argument by the internal function sub_44B438. An unauthenticated remote attacker can exploit this flaw to overwrite stack memory by supplying a specially crafted, oversized input string to the vulnerable parameter. Successful exploitation can lead to arbitrary code execution, system instability, or complete denial of service (DoS) of the targeted network device. Given that public exploit code has been released, the risk of active exploitation in the wild is significantly elevated. The attack requires network connectivity to the management interface of the vulnerable device, enabling remote execution without prior authentication privileges.",
  "technicalDetails": "The vulnerability resides in the SSID Configuration component of the Comfast CF-N1-S firmware version 2.6.0.1, specifically within the binary handler responsible for processing configuration updates via the Common Gateway Interface (CGI). The execution flow reaches the vulnerable function sub_44B438 when an HTTP GET or POST request is directed to the URI path /cgi-bin/mbox-config with the query parameters method=SET and section=ptest_ssid. Within sub_44B438, the application extracts the value associated with the ssid argument from the incoming HTTP request. The root cause of the vulnerability is the lack of proper bounds checking and input validation before copying the user-supplied ssid string into a fixed-size stack buffer. When an attacker transmits an input payload that exceeds the allocated buffer capacity, a stack-based buffer overflow occurs. This overflow corrupts adjacent stack memory, which typically includes saved frame pointers and the return instruction pointer (LR or PC depending on the architecture). By carefully structuring the payload, an attacker can hijack the control flow of the application to execute arbitrary machine instructions. The attack is fully executable over the network, allowing remote actors to target devices exposed to local area networks or wide area networks if the management interface is misconfigured. Exploitation does not explicitly require prior authentication based on the provided URI context, lowering the barrier to entry for potential adversaries. Post-exploitation impact includes full compromise of the underlying operating system running on the Comfast CF-N1-S device, potentially facilitating lateral movement, interception of network traffic, or persistent backdoor installation."
}