제출 #881293: Comfast CF-N1-S V2.6.0.1 Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router, specifically in the `sub_41AD7C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ntp_timezone`.

After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by constructing a valid session, thereby entering the NTP time zone configuration processing flow. Triggering this vulnerability requires two conditions to be met simultaneously: the request body must contain the `timestr` field, and the value of the `ntp_client_enabled` field must be `“0”`. Both values are directly extracted from the request body and are fully controllable by the attacker.

In the vulnerability execution path, the user-controlled parameter `timestr` is passed to the `off_47D1FC` (`sprintf`) function, formatted according to the format string `&aDateSSDevNull` (corresponding to `“date -s \”%s\“ > /dev/null”`), and ultimately written to the fixed-size stack buffer `v10`.

Since this write operation does not perform any valid length restrictions or boundary checks on the input, a stack buffer overflow occurs when the length of the `timestr` parameter exceeds the buffer’s capacity.

An attacker can precisely control the length and content of `timestr` to corrupt the current function’s stack frame structure, ultimately causing the program to crash and, under specific conditions, potentially leading to a controllable control flow hijacking risk.

• 원천: ⚠️ https://github.com/AdminSafe/CVE/issues/9
• 사용자: 010hex (UID 99386)
• 제출: 2026. 07. 06. PM 03:24 (2 개월 ago)
• 모더레이션: 2026. 08. 22. AM 10:08 (2 months later)
• 상태: 수락
• VulDB 항목: 394291 [Comfast CF-N1-S 2.6.0.1 Web Management mbox-config?method=SET§ion=ntp_timezone sub_41AD7C timestr/ntp_client_enabled 메모리 손상]
• 포인트들: 20