CVE-2026-6799: Comfast CF-N1-S Endpoint mbox-config command injection
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET§ion=pingconfig of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6799?
CVE-2026-6799 has a moderate severity rating due to the risk of command injection.
How do I fix CVE-2026-6799?
To fix CVE-2026-6799, update the Comfast CF-N1-S device to the latest firmware version that addresses this vulnerability.
What components are affected by CVE-2026-6799?
CVE-2026-6799 affects the /cgi-bin/mbox-config?method=SET§ion=ping_config functionality of the Comfast CF-N1-S 2.6.0.1 device.
What exploitation methods are associated with CVE-2026-6799?
CVE-2026-6799 can be exploited via crafted requests that manipulate the command arguments in the affected endpoint.
What are the potential impacts of CVE-2026-6799?
Successful exploitation of CVE-2026-6799 may allow an attacker to execute arbitrary commands on the Comfast CF-N1-S device.