Submit #878007: Comfast CF-N1-S V2.6.0.1 Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the get_para_from_uri() function of the COMFAST CF-N1-S wireless router firmware version V2.6.0.1, released on March 1, 2024. During the analysis of the firmware binary extracted from the official distribution, the function was identified at address 0x00406882 within the webcfg_main() execution path, specifically invoked when handling HTTP GET requests to the /cgi-bin/mbox-config endpoint.
The vulnerability stems from how user-supplied URI parameters are parsed and copied into memory. When a request such as /cgi-bin/mbox-config?width=A&height=B is received, the backend CGI program calls strstr() to locate the parameter name—for instance, "height="—within the request URI. The function then enters a tight loop, walking character by character through the subsequent input and writing each byte into a fixed-size stack buffer pointed to by register $a3. The loop continues until it encounters either an ampersand (&) denoting the next parameter or a null terminator marking the end of the string. Critically, at no point does the function verify whether the accumulated data exceeds the allocated buffer boundary.
Because there is no length validation or byte limitation enforced during this copy operation, an attacker can supply an arbitrarily long value for the width or height parameter. The excessive input overflows the intended stack buffer, progressively overwriting adjacent stack frames and eventually corrupting the saved return address. In a QEMU-emulated MIPS environment, this condition reliably triggers a segmentation fault, causing the FastCGI management server listening on 127.0.0.1:9002 to crash with an uncaught signal 11. The crash dump confirms that the processor attempted to execute or return to an invalid address, a direct consequence of the overwritten control data on the stack.
What makes this flaw particularly severe is its accessibility. The vulnerable endpoint can be reached remotely without any prior authentication or active session. A single, carefully crafted HTTP GET request containing an oversized parameter value is sufficient to destabilize the device. While the immediate observed impact is a denial of service through process termination, the underlying nature of the stack overflow presents a viable path for remote code execution. An attacker with precise knowledge of the firmware’s memory layout could potentially overwrite the return address with a pointer to shellcode, hijacking the control flow of the CGI process.
In summary, COMFAST CF-N1-S V2.6.0.1 fails to sanitize or bound-check URI parameter values in its get_para_from_uri() routine, leaving the device exposed to unauthenticated stack buffer overflow attacks via the web management interface.

• Source: ⚠️ https://github.com/1ChaoRen1/IOT_3
• User: ChaoRenChaoJiWuDi (UID 99392)
• Submission: 07/02/2026 14:25 (2 months ago)
• Moderation: 08/18/2026 20:53 (2 months later)
• Status: Accepted
• VulDB entry: 391922 [Comfast CF-N1-S 2.6.0.1 URI Parameter Parsing /cgi-bin/mbox-config get_para_from_uri width/height stack-based overflow]
• Points: 20