Executive brief
Comfast CF-N1-S routers contain a stack-based buffer overflow vulnerability in the web-based configuration interface that manages Wi-Fi SSID settings. An authenticated attacker can send a specially crafted HTTP request with an oversized SSID parameter, causing the device to crash and potentially allowing arbitrary code execution with the privileges of the web service. Successful exploitation could grant an attacker complete control over the router and access to all network traffic and connected devices.
Technical details
A stack-based buffer overflow vulnerability exists in the /cgi-bin/mbox-config endpoint (function sub_44B438) when processing SSID configuration changes via POST requests with the section=ptest_ssid parameter. The vulnerable code reads the user-supplied "ssid" parameter and formats it into a 64-byte stack buffer without performing length validation or boundary checks. An authenticated attacker can supply an SSID value exceeding 64 bytes, triggering a stack overflow that overwrites the return address. The attack requires a valid session (authenticated access) and can be delivered remotely via HTTP POST. No patch is currently documented in the advisory materials.
Affected products
- Comfast CF-N1-S 2.6.0.1
Timeline
- 2026-07-05: disclosed: Vulnerability report published on GitHub
- 2026-08-20: advisory: CVE-2026-77022 published on NVD