| Название | Comfast CF-N1-S V2.6.0.1 Command Injection |
|---|
| Описание | Vulnerability Summary:
A command injection vulnerability exists in the ptest_macaddress handler of the COMFAST CF-N1-S router firmware version V2.6.0.1. The vulnerability allows authenticated attackers to execute arbitrary operating system commands via the "macaddress" parameter in a POST request to /cgi-bin/mbox-config.
Technical Details:
In the function sub_44A968 (ptest_macaddress handler), user-supplied input from the "macaddress" JSON parameter is directly concatenated into a shell command string using sprintf(), which is then executed via popen() without proper sanitization or validation.
The vulnerable code path:
1. The web management interface receives a POST request to /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress
2. The JSON body contains a "macaddress" parameter
3. The function sub_44A968 extracts this parameter via off_47D1D4 (parameter parser)
4. The value is concatenated into a command buffer using sprintf() (off_47D1FC)
5. The constructed command is executed via popen() (off_47D308)
Example vulnerable payload:
POST /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: application/json
Cookie: COMFAST_SESSIONID=<valid_session>
{"macaddress":"127.0.0.1`;touch /tmp/pwned.txt;#"}
This results in the execution of: ptest_setmac 127.0.0.1`;touch /tmp/pwned.txt;#`
Impact:
Successful exploitation allows an authenticated attacker to:
- Execute arbitrary commands with root privileges
- Read sensitive configuration files (/etc/config/*)
- Modify device firmware or install persistent backdoors
- Use the device as a pivot point for lateral movement
Affected Product:
- Vendor: COMFAST (Shenzhen Four Seas Global Link Network Technology Co., Ltd.)
- Product: CF-N1-S Wireless Router
- Firmware Version: V2.6.0.1 (released 2024-03-01)
- Architecture: MIPS (big-endian)
- Base: OpenWrt Linux 3.10.44
Attack Vector:
- Network-based
- Requires authentication (default credentials: admin/admin)
- Attack Complexity: Low |
|---|
| Источник | ⚠️ https://github.com/1ChaoRen1/IOT |
|---|
| Пользователь | ChaoRenChaoJiWuDi (UID 99392) |
|---|
| Представление | 30.06.2026 08:07 (2 месяцы назад) |
|---|
| Модерация | 16.08.2026 13:59 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 391155 [COMFAST CF-N1-S 2.6.0.1 mbox-config?method=SET§ion=ptest_macaddress sub_44A968 эскалация привилегий] |
|---|
| Баллы | 19 |
|---|