| Titre | Comfast CF-N1-S V2.6.0.1 Buffer Overflow |
|---|
| Description | A stack-based buffer overflow vulnerability exists in the web management interface of the COMFAST CF-N1-S V2 router running firmware version V2.6.0.1.
The vulnerability exists in the `get_css_path_from_uri` function, which is responsible for extracting the path portion of an HTTP request URI (i.e., the content following `/cgi-bin/` and preceding the `?` character) and copying it byte-by-byte into a fixed-size stack buffer.
The function uses only the “?” character or a string terminator as a stop condition and performs neither input length validation nor boundary checks on the target buffer’s capacity.
Furthermore, this endpoint does not enforce session authentication, so the vulnerability can be triggered without any valid credentials. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP GET request to the `/cgi-bin/mbox-config/` endpoint. The URI path of this request contains an excessively long string (which also includes the required `height` and `width` parameters), causing the oversized data to overwrite adjacent stack memory, including local variables, saved registers, and the function return address.
This causes the web management process to crash (denial of service). Under certain conditions, a successful exploit of this vulnerability may also lead to control flow hijacking and the execution of arbitrary code with the privileges of the web service, ultimately resulting in a complete compromise of the device. |
|---|
| La source | ⚠️ https://github.com/AdminSafe/CVE/issues/12 |
|---|
| Utilisateur | 010hex (UID 99386) |
|---|
| Soumission | 24/08/2026 15:22 (il y a 27 jours) |
|---|
| Modérer | 19/09/2026 16:51 (26 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 407952 [Comfast CF-N1-S 2.6.0.1 Web Management Interface /cgi-bin/mbox-config get_css_path_from_uri buffer overflow] |
|---|
| Points | 20 |
|---|