CVE-2026-3798: Comfast CF-AC100 Request Path mbox-config sub_44AC14 command injection
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=pingconfig of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3798?
CVE-2026-3798 is classified as a high severity vulnerability due to its potential for command injection.
How do I fix CVE-2026-3798?
To fix CVE-2026-3798, update the Comfast CF-AC100 firmware to the latest version that addresses this security flaw.
What specific component is affected by CVE-2026-3798?
CVE-2026-3798 affects the Request Path Handler in the Comfast CF-AC100 device.
Can CVE-2026-3798 be exploited remotely?
Yes, CVE-2026-3798 can be exploited remotely through the vulnerable /cgi-bin/mbox-config interface.
Which version of the Comfast CF-AC100 is impacted by CVE-2026-3798?
CVE-2026-3798 affects Comfast CF-AC100 version 2.6.0.8.