CVE-2026-2824: Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection
A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=pingconfig of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2824?
The severity of CVE-2026-2824 is classified as critical due to the potential for command injection.
How do I fix CVE-2026-2824?
To fix CVE-2026-2824, update your Comfast CF-E7 device to the latest firmware version that addresses this vulnerability.
What are the potential impacts of CVE-2026-2824?
CVE-2026-2824 can allow attackers to execute arbitrary commands on the affected Comfast CF-E7 devices, potentially compromising entire systems.
Which product is affected by CVE-2026-2824?
The product affected by CVE-2026-2824 is the Comfast CF-E7.
What versions are affected by CVE-2026-2824?
CVE-2026-2824 affects the Comfast CF-E7 version 2.6.0.9.