CVE-2026-2823: Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntptimezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2823?
CVE-2026-2823 is classified as a command injection vulnerability.
How do I fix CVE-2026-2823?
To fix CVE-2026-2823, it is recommended to update the Comfast CF-E7 to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2026-2823?
CVE-2026-2823 can allow an attacker to execute arbitrary commands on the affected system.
Which products are affected by CVE-2026-2823?
CVE-2026-2823 affects the Comfast CF-E7 version 2.6.0.9.
How can I determine if my system is vulnerable to CVE-2026-2823?
You can determine if your system is vulnerable to CVE-2026-2823 by checking if you are running the Comfast CF-E7 version 2.6.0.9.