CVE-2026-77683: Comfast CF-N1-S mbox-config system command injection

Published Aug 21, 2026

Updated

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Affected Software

1 affected component

Comfast CF-N1-S=2.6.0.1

Event History

Aug 21, 2026

CVE Published

via MITRE·10:15 AM

Data Sourced

via MITRE·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must have low-privileged access, but exploitation can be performed remotely and does not require user interaction.

Which input and endpoint are involved?

The vulnerable path is /cgi-bin/mbox-config?method=SET&section=ntp_timezone. Command injection occurs through manipulation of the timestr argument passed to the system function.

Is public exploit code available?

Yes. The exploit has been publicly released and may be used in attacks.