Submeter #881293: Comfast CF-N1-S V2.6.0.1 Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router, specifically in the `sub_41AD7C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ntp_timezone`.

After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by constructing a valid session, thereby entering the NTP time zone configuration processing flow. Triggering this vulnerability requires two conditions to be met simultaneously: the request body must contain the `timestr` field, and the value of the `ntp_client_enabled` field must be `“0”`. Both values are directly extracted from the request body and are fully controllable by the attacker.

In the vulnerability execution path, the user-controlled parameter `timestr` is passed to the `off_47D1FC` (`sprintf`) function, formatted according to the format string `&aDateSSDevNull` (corresponding to `“date -s \”%s\“ > /dev/null”`), and ultimately written to the fixed-size stack buffer `v10`.

Since this write operation does not perform any valid length restrictions or boundary checks on the input, a stack buffer overflow occurs when the length of the `timestr` parameter exceeds the buffer’s capacity.

An attacker can precisely control the length and content of `timestr` to corrupt the current function’s stack frame structure, ultimately causing the program to crash and, under specific conditions, potentially leading to a controllable control flow hijacking risk.

• Fonte: ⚠️ https://github.com/AdminSafe/CVE/issues/9
• Utilizador: 010hex (UID 99386)
• Submissão: 06/07/2026 15h24 (há 2 meses)
• Moderação: 22/08/2026 10h08 (2 months later)
• Estado: Aceite
• Entrada VulDB: 394291 [Comfast CF-N1-S 2.6.0.1 Web Management mbox-config?method=SET§ion=ntp_timezone sub_41AD7C timestr/ntp_client_enabled Excesso de tampão]
• Pontos: 20