# CVE-2026-77022: Comfast CF-N1-S stack-based buffer overflow in SSID configuration

Source: https://junglewise.ai/threats/cve-2026-77022-comfast-cf-n1-s-stack-based-buffer-overflow-in-ssid-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77022 · Severity: critical · CVSS 9.9 · Published 2026-08-20

Comfast CF-N1-S routers contain a stack-based buffer overflow vulnerability in the web-based configuration interface that manages Wi-Fi SSID settings. An authenticated attacker can send a specially crafted HTTP request with an oversized SSID parameter, causing the device to crash and potentially allowing arbitrary code execution with the privileges of the web service. Successful exploitation could grant an attacker complete control over the router and access to all network traffic and connected devices.

Technologies: [Comfast CF-N1-S](https://junglewise.ai/threats/technologies/cf-n1-s). Vendors: [Comfast](https://junglewise.ai/threats/vendors/comfast).

## Quick answers

**Is CVE-2026-77022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77022 being exploited in the wild.

**How severe is CVE-2026-77022?** Critical severity, with a CVSS score of 9.9, published 20 August 2026.

**Which products and versions are affected?** Comfast CF-N1-S 2.6.0.1.

**Is there a fix for CVE-2026-77022?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77022 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-77022?** Check whether you run Comfast CF-N1-S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the /cgi-bin/mbox-config endpoint (function sub_44B438) when processing SSID configuration changes via POST requests with the section=ptest_ssid parameter. The vulnerable code reads the user-supplied "ssid" parameter and formats it into a 64-byte stack buffer without performing length validation or boundary checks. An authenticated attacker can supply an SSID value exceeding 64 bytes, triggering a stack overflow that overwrites the return address. The attack requires a valid session (authenticated access) and can be delivered remotely via HTTP POST. No patch is currently documented in the advisory materials.

## Affected products

- Comfast CF-N1-S 2.6.0.1

## Timeline

- 2026-07-05: disclosed: Vulnerability report published on GitHub
- 2026-08-20: advisory: CVE-2026-77022 published on NVD

## References

- [https://github.com/AdminSafe/CVE/issues/5](https://github.com/AdminSafe/CVE/issues/5)
- [https://vuldb.com/cve/CVE-2026-77022](https://vuldb.com/cve/CVE-2026-77022)

## Related threats

- [Comfast CF-N1-S stack-based buffer overflow in web management](https://junglewise.ai/threats/cve-2026-94003-a-vulnerability-has-been-found-in-comfast-cf-n1-s-2-6-0-1)
- [Comfast CF-N1-S command injection in webmgnt](https://junglewise.ai/threats/cve-2026-75364-comfast-cf-n1-s-command-injection-in-webmgnt)
- [Comfast CF-N1-S stack buffer overflow in NTP timezone configuration](https://junglewise.ai/threats/cve-2026-78050-comfast-cf-n1-s-stack-buffer-overflow-in-ntp-timezone)
- [Comfast CF-N1-S command injection in NTP timezone](https://junglewise.ai/threats/cve-2026-77683-comfast-cf-n1-s-command-injection-in-ntp-timezone)
- [Comfast CF-N1-S stack-based buffer overflow in web management](https://junglewise.ai/threats/cve-2026-77148-comfast-cf-n1-s-stack-based-buffer-overflow-in-web-management)