CVE-2026-77004: Comfast CF-N1-S command injection in mbox-config

Executive brief

The Comfast CF-N1-S is a networking device used in small business and residential deployments. A vulnerability in its web configuration interface allows remote attackers to inject arbitrary commands by manipulating request parameters, potentially leading to complete device compromise and network infiltration.

Technical details

A command injection vulnerability exists in the /cgi-bin/mbox-config endpoint (method=SET&section=ptest_sn) due to unsafe use of the sprintf function when processing the sn argument. The vulnerability is reached over the network without requiring authentication. An attacker can manipulate the sn parameter to inject shell commands that execute with device privileges. The exploit code has been publicly released.

Affected products

• Comfast CF-N1-S 2.6.0.1

Timeline

• 2026-08-20: disclosed: Advisory published on NVD

References

• https://github.com/lxiansheng488-bit/-/blob/main/%E5%8E%82%E5%95%86comefast%20%20CF-N1-S%20V2.pdf
• https://vuldb.com/cve/CVE-2026-77004