Description

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-21T11:17:06.457Z",
  "pubdate": "2026-08-21T11:17:06.457Z",
  "executiveSummary": "A critical security flaw has been identified in the Comfast CF-N1-S running version 2.6.0.1, specifically within the system function handling network time protocol configurations. This vulnerability is classified as an OS command injection flaw, arising from the insecure processing of user-supplied input.\nThe vulnerability allows remote unauthenticated or remote attackers to execute arbitrary system commands with the privileges of the underlying web service or root user, depending on the daemon configuration. Successful exploitation leads to total compromise of the affected device, enabling malicious actors to manipulate system settings, intercept network traffic, use the device as a pivot point in the internal network, or cause a permanent denial of service.\nThe flaw affects the Comfast CF-N1-S product at version 2.6.0.1. Given that public exploit code has been released and actively monitored, the risk implications are severe. Exploitation can be executed entirely remotely over the network without requiring prior physical access or complex interaction, significantly lowering the barrier to entry for potential threat actors.\nMitigation options are constrained by the availability of vendor patches; however, operational network segmentation, perimeter firewall controls, and disabling remote management access can effectively minimize exposure to this remote threat vector.",
  "technicalDetails": "The vulnerability resides in the CGI binary handler exposed via the HTTP endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone on the Comfast CF-N1-S device running firmware version 2.6.0.1.\nThe root cause of the vulnerability is improper input validation and unsafe sanitization of parameters passed to the operating system shell. Specifically, the function system responsible for processing configuration updates directly incorporates the untrusted input parameter timestr without adequate escaping or the use of safe API alternatives such as execve with argument arrays.\nThe attack vector is network-based and exploitable remotely via the HTTP protocol. An attacker crafts a malicious HTTP GET or POST request directed at the /cgi-bin/mbox-config endpoint. By supplying specially crafted shell metacharacters, command separators (such as semicolons, pipes, or backticks), and malicious payloads within the timestr parameter, the attacker can break out of the intended argument context and append arbitrary shell commands.\nUpon receiving the malicious request, the web application passes the concatenated string directly to the underlying system shell for execution. The vulnerable system function interprets the injected characters as operational commands, executing them immediately within the context of the running process.\nBecause the affected component frequently operates with elevated privileges, the execution of arbitrary commands results in immediate privilege escalation or persistence. Post-exploitation impact includes unauthorized reading and writing of sensitive configuration files, extraction of stored credentials, firmware tampering, and complete loss of device integrity.\nNo complex exploitation requirements or prior authentication bypasses are explicitly documented, indicating that the endpoint may process the malicious request directly. Public availability of the exploit payload accelerates the risk of automated scanning and exploitation by malicious actors on the internet."
}