CVE-2026-75094: COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Which systems and interface are affected?
The affected product is COMFAST CF-N1-S firmware version 2.6.0.1. The vulnerable CGI endpoint is /cgi-bin/mbox-config with method=SET and section=ptest_ssid.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely by manipulating the ssid argument sent to the affected CGI function. The vulnerability has low attack complexity, requires high privileges, and does not require user interaction.
Are devices affected in their default configuration?
The available data does not state whether the affected CGI interface is exposed or reachable in the product's default configuration. Exposure depends on whether an attacker can access the device's CGI interface and has the required privileges.
How can I determine whether a device is affected?
Treat devices running version 2.6.0.1 as affected if their CGI interface exposes the mbox-config SET request for section ptest_ssid. The published exploit indicates that exploitation techniques may be available.