CVE-2026-4467: Comfast CF-AC100 mbox-config command injection

Published Mar 20, 2026

Updated

A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=wirelessdevicedissoc. The manipulation results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Comfast CF-AC100=2.6.0.8

Event History

Mar 20, 2026

CVE Published

via MITRE·02:32 AM

Data Sourced

via MITRE·02:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Sep 22, 58202

Event

via FIRST·12:21 PM

Frequently Asked Questions

What is the severity of CVE-2026-4467?

CVE-2026-4467 is classified as a high severity vulnerability due to its potential for remote command injection.

How do I fix CVE-2026-4467?

To remediate CVE-2026-4467, update the Comfast CF-AC100 device to the latest firmware version that addresses this vulnerability.

What is the impact of CVE-2026-4467?

CVE-2026-4467 allows an attacker to execute arbitrary commands on the vulnerable Comfast CF-AC100 device remotely.

Which versions of the Comfast CF-AC100 are affected by CVE-2026-4467?

CVE-2026-4467 specifically affects Comfast CF-AC100 version 2.6.0.8.

How can CVE-2026-4467 be exploited?

CVE-2026-4467 can be exploited by manipulating the URL parameters sent to the '/cgi-bin/mbox-config' endpoint.