Description

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-23T00:16:50.590Z",
  "pubdate": "2026-08-23T00:16:50.590Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Comfast CF-N1-S 2.6.0.1 firmware. The flaw exists within the Web Management component, specifically in the function sub_41AD7C when processing requests to the endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone.\nThe vulnerability is triggered by improper bounds checking on user-supplied input passed via the timestr or ntp_client_enabled arguments. An unauthenticated remote attacker can exploit this weakness by submitting a specially crafted HTTP request containing an oversized payload designed to overflow the destination stack buffer.\nSuccessful exploitation of this vulnerability can lead to memory corruption, potentially allowing remote code execution, arbitrary command execution, or a complete denial of service (DoS) of the affected networking device. Given that the exploit has been made public, the risk of active exploitation in the wild is elevated.\nThe attack vector is network-accessible, requiring no prior authentication or privileged access to the management interface, thereby significantly lowering the attack complexity for malicious actors targeting exposed administrative endpoints.",
  "technicalDetails": "The vulnerability resides in the Web Management component of the Comfast CF-N1-S 2.6.0.1 firmware, specifically inside the binary function sub_41AD7C. This function is invoked during the parsing of configuration parameters submitted via the CGI endpoint located at /cgi-bin/mbox-config?method=SET&section=ntp_timezone.\nThe root cause of the vulnerability is a classic stack-based buffer overflow resulting from unsafe handling of input strings. The function processes parameters such as timestr and ntp_client_enabled without implementing adequate length validation or input sanitization prior to copying the data into a fixed-size buffer allocated on the stack.\nTo execute an attack, a remote threat actor sends an HTTP request to the vulnerable CGI endpoint with a maliciously crafted payload injected into the timestr or ntp_client_enabled parameter fields. Because the input exceeds the expected byte length of the destination buffer, the excessive data overflows the stack frame boundaries.\nThis overflow overwrites adjacent stack memory, which can include saved frame pointers and return addresses. When the vulnerable function sub_41AD7C attempts to return execution flow, the instruction pointer is redirected to an attacker-controlled memory location if the return address is successfully hijacked with shellcode or via return-oriented programming (ROP) chains.\nThe attack flow proceeds as follows: 1) The attacker identifies the remote management service exposed over the network. 2) The attacker crafts an HTTP GET or POST request targeting /cgi-bin/mbox-config?method=SET&section=ntp_timezone. 3) The request embeds an excessively long string within the timestr or ntp_client_enabled parameters. 4) The web server passes the request to the underlying binary, where function sub_41AD7C copies the unbounded input into a stack buffer via unsafe string manipulation routines. 5) The stack is corrupted, resulting in application crash or arbitrary code execution with the privileges of the web server process.\nThe vulnerability is exploitable remotely over the network without requiring authentication credentials or prior system privileges, exposing vulnerable devices directly connected to local or wide-area networks to complete compromise."
}