| タイトル | Comfast CF-N1-S V2.6.0.1 Command Injection |
|---|
| 説明 | CVE ID: [Reserved]
Title: Command Injection in COMFAST CF-N1-S Router Firmware V2.6.0.1
Description:
A command injection vulnerability exists in the sub_44B438() function of the /cgi-bin/mbox-config CGI interface in COMFAST CF-N1-S router firmware version V2.6.0.1 (released 2024-03-01). The vulnerability is triggered via the ptest_ssid configuration section when the HTTP request method is set to SET.
The root cause is that user-supplied input from the HTTP POST request body (specifically the ssid JSON field) is concatenated into a command string using sprintf() at line 20, and subsequently executed via execl() at line 23 without proper sanitization or validation. This allows an authenticated attacker to inject arbitrary operating system commands.
Affected Product / Version:
Vendor: COMFAST
Product: CF-N1-S (Wireless Router / AP / CPE)
Firmware Version: V2.6.0.1
Release Date: 2024-03-01
Attack Vector:
Network
Authentication: Required (admin panel access)
Vulnerable Endpoint:
POST /cgi-bin/mbox-config?method=SET§ion=ptest_ssid HTTP/1.1
Host: [target]
Content-Type: application/json
Cookie: COMFAST_SESSIONID=[valid_session]
Content-Length: 31
{"ssid":" touch 888.txt"}
Impact:
Successful exploitation allows a remote authenticated attacker to execute arbitrary commands with root privileges on the underlying operating system, leading to complete device compromise, unauthorized access to sensitive data, and potential lateral movement within the network.
Steps to Reproduce:
Access the COMFAST CF-N1-S V2.6.0.1 web administration interface.
Authenticate with valid credentials (default: admin/admin).
Intercept the request to /cgi-bin/mbox-config?method=SET§ion=ptest_ssid using Burp Suite or similar proxy tool.
Modify the POST request body to inject an OS command into the ssid parameter, e.g., {"ssid":" touch 888.txt"}.
Observe that the command is executed on the device, creating the file /888.txt (or equivalent payload effect) in the root filesystem. |
|---|
| ソース | ⚠️ https://github.com/1ChaoRen1/IOT_1 |
|---|
| ユーザー | ChaoRenChaoJiWuDi (UID 99392) |
|---|
| 送信 | 2026年07月02日 04:56 (2 月 ago) |
|---|
| モデレーション | 2026年08月17日 18:46 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 391346 [COMFAST CF-N1-S 2.6.0.1 CGI Interface mbox-config?method=SET§ion=ptest_ssid sub_44B438 特権昇格] |
|---|
| ポイント | 20 |
|---|