| Título | Comfast CF-N1-S V2.6.0.1 Authenticated Command Injection |
|---|
| Descrição | There is an operating system command injection vulnerability in the web management component of the COMFAST CF-N1-S V2 router, specifically located in the `sub_44B50C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ptest_channel`.
After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by establishing a valid session, thereby entering the channel configuration processing flow.
In the exploit chain, the user-controllable `channel` parameter (corresponding to the global configuration item `off_469530`) is passed to the `off_47D1FC` (`sprintf`) function for formatting. The format string is “ptest setchannel %s,” and the generated command string is forwarded via the stack buffer `v4` to the `off_47D394` (`system`) function for execution.
Since this formatting and concatenation process does not perform any valid input validation, length restrictions, or filtering of dangerous characters on user input, an attacker can inject shell metacharacters (such as semicolons, vertical bars, backticks, or $(cmd), etc.) into the `channel` parameter, causing operating system commands to be appended to the “ptest setchannel” command and executed together.
Once the command injection is successful, an attacker can execute arbitrary operating system commands on the target device with system privileges, thereby gaining complete control over the device’s behavior, including but not limited to modifying system configurations, implanting malicious programs, establishing a reverse shell, or causing permanent damage to the device. |
|---|
| Fonte | ⚠️ https://github.com/AdminSafe/CVE/issues/6 |
|---|
| Utilizador | 010hex (UID 99386) |
|---|
| Submissão | 05/07/2026 16h45 (há 3 meses) |
|---|
| Moderação | 20/08/2026 10h39 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 346123 [Comfast CF-N1 V2 2.6.0.2 mbox-config?method=SET§ion=ptest_channel sub_44AB9C Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|