| शीर्षक | Comfast CF-N1-S V2 V2.6.0.1 Buffer Overflow |
|---|
| विवरण | A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router, specifically in the sub_44B438 function. This function processes the HTTP request /cgi-bin/mbox-config, and the relevant logic is triggered when method=SET and section=ptest_ssid.
After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device using a valid session cookie, thereby entering the SSID configuration processing flow.
In the exploit chain, the user-controlled parameter `ssid` (corresponding to the global configuration item `off_469538`) is passed to the `off_47D1FC` function for formatting and is ultimately written to a fixed-size buffer `v5` on the stack.
Since this write operation resembles the insecure formatting behavior of `sprintf` and does not perform any valid length restrictions or boundary checks on the input, a stack buffer overflow occurs when the length of the `ssid` parameter exceeds the buffer’s capacity.
Once the overflow occurs, an attacker can overwrite adjacent local variables and the function return address, corrupting the current function’s stack frame structure, which ultimately causes the program to crash. Under specific conditions, this may also pose a risk of controllable control flow hijacking. |
|---|
| स्रोत | ⚠️ https://github.com/AdminSafe/CVE/issues/5 |
|---|
| उपयोगकर्ता | 010hex (UID 99386) |
|---|
| सबमिशन | 05/07/2026 03:02 PM (2 महीनों पहले) |
|---|
| संयम | 20/08/2026 10:33 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 393637 [Comfast CF-N1-S 2.6.0.1 SSID Configuration mbox-config?method=SET§ion=ptest_ssid sub_44B438 बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|