| タイトル | Comfast CF-N1-S V2.6.0.1 Buffer Overflow |
|---|
| 説明 | A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router, specifically in the sub_44B50C function. This function processes the HTTP request /cgi-bin/mbox-config, and the relevant logic is triggered when method=SET and section=channel.
After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by constructing a valid session, thereby entering the channel configuration processing flow.
In the exploit chain, the user-controlled parameter `channel` (corresponding to the global configuration item `off_469530`) is passed to the `off_47D1FC` function for formatting and is ultimately written to a fixed-size stack buffer `v4`.
Since this write operation does not perform any valid length restrictions or boundary checks on the input, a stack buffer overflow occurs when the length of the `channel` parameter exceeds the buffer’s capacity.
After the overflow occurs, an attacker can overwrite adjacent local variables and the function’s return address, corrupting the current function’s stack frame structure, which ultimately causes the program to crash. Under specific conditions, this may also lead to a risk of controlled control flow hijacking. |
|---|
| ソース | ⚠️ https://github.com/AdminSafe/CVE/issues/7 |
|---|
| ユーザー | 010hex (UID 99386) |
|---|
| 送信 | 2026年07月06日 05:25 (2 月 ago) |
|---|
| モデレーション | 2026年08月20日 15:49 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 393733 [Comfast CF-N1-S 2.6.0.1 Web Management mbox-config?method=SET§ion=ptest_channel sub_44B50C メモリ破損] |
|---|
| ポイント | 20 |
|---|