CVE-2026-4466: Comfast CF-AC100 mbox-config command injection

Published Mar 20, 2026

Updated

A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntptimezone. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Comfast CF-AC100=2.6.0.8

Event History

Mar 20, 2026

CVE Published

via MITRE·02:02 AM

Data Sourced

via MITRE·02:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Sep 22, 58202

Event

via FIRST·04:49 PM

Frequently Asked Questions

What is the severity of CVE-2026-4466?

CVE-2026-4466 is classified with a high severity due to the risk of remote command injection.

How do I fix CVE-2026-4466?

To fix CVE-2026-4466, update the Comfast CF-AC100 firmware to the latest version that addresses this vulnerability.

What systems are affected by CVE-2026-4466?

CVE-2026-4466 affects the Comfast CF-AC100 version 2.6.0.8.

Can CVE-2026-4466 be exploited remotely?

Yes, CVE-2026-4466 allows for remote exploitation via the vulnerable mbox-config command.

What type of vulnerability is CVE-2026-4466?

CVE-2026-4466 is a command injection vulnerability that enables attackers to execute arbitrary commands.