提出 #880632: Comfast CF-N1-S V2.6.0.1 Authenticated Command Injection

There is an operating system command injection vulnerability in the web management component of the COMFAST CF-N1-S V2 router, specifically located in the `sub_44B50C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ptest_channel`.

After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by establishing a valid session, thereby entering the channel configuration processing flow.

In the exploit chain, the user-controllable `channel` parameter (corresponding to the global configuration item `off_469530`) is passed to the `off_47D1FC` (`sprintf`) function for formatting. The format string is “ptest setchannel %s,” and the generated command string is forwarded via the stack buffer `v4` to the `off_47D394` (`system`) function for execution.

Since this formatting and concatenation process does not perform any valid input validation, length restrictions, or filtering of dangerous characters on user input, an attacker can inject shell metacharacters (such as semicolons, vertical bars, backticks, or $(cmd), etc.) into the `channel` parameter, causing operating system commands to be appended to the “ptest setchannel” command and executed together.

Once the command injection is successful, an attacker can execute arbitrary operating system commands on the target device with system privileges, thereby gaining complete control over the device’s behavior, including but not limited to modifying system configurations, implanting malicious programs, establishing a reverse shell, or causing permanent damage to the device.

• ソース: ⚠️ https://github.com/AdminSafe/CVE/issues/6
• ユーザー: 010hex (UID 99386)
• 送信: 2026年07月05日 16:45 (3 月 ago)
• モデレーション: 2026年08月20日 10:39 (2 months later)
• ステータス: 重複
• VulDBエントリ: 346123 [Comfast CF-N1 V2 2.6.0.2 mbox-config?method=SET§ion=ptest_channel sub_44AB9C 特権昇格]
• ポイント: 0