Executive brief
Comfast CF-N1-S is a WiFi router with a web-based management interface. A stack buffer overflow vulnerability in the NTP timezone settings allows a remote attacker with network access to send a malicious HTTP request and execute arbitrary code on the device, potentially compromising all traffic routed through it or enabling lateral movement into the network.
Technical details
The vulnerability is a stack-based buffer overflow in the sub_41AD7C function of the web management endpoint /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The function accepts a 'timestr' parameter via JSON POST body and passes it unsanitized to sprintf(), which concatenates it with the format string "date -s \"%s\" > /dev/null" before writing to a fixed-size stack buffer. No bounds checking occurs, allowing an attacker to overwrite the return address with a long timestr value. The attack requires network reachability to the router's web interface (typically requires a valid session or unauthenticated access depending on configuration). Proof-of-concept code has been publicly disclosed, and exploit code is available.
Affected products
- Comfast CF-N1-S 2.6.0.1
Timeline
- 2026-07-06: disclosed: Vulnerability report published on GitHub
- 2026-08-23: advisory: CVE-2026-78050 published