Submit #880632: Comfast CF-N1-S V2.6.0.1 Authenticated Command Injectioninfo

TitleComfast CF-N1-S V2.6.0.1 Authenticated Command Injection
DescriptionThere is an operating system command injection vulnerability in the web management component of the COMFAST CF-N1-S V2 router, specifically located in the `sub_44B50C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ptest_channel`. After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by establishing a valid session, thereby entering the channel configuration processing flow. In the exploit chain, the user-controllable `channel` parameter (corresponding to the global configuration item `off_469530`) is passed to the `off_47D1FC` (`sprintf`) function for formatting. The format string is “ptest setchannel %s,” and the generated command string is forwarded via the stack buffer `v4` to the `off_47D394` (`system`) function for execution. Since this formatting and concatenation process does not perform any valid input validation, length restrictions, or filtering of dangerous characters on user input, an attacker can inject shell metacharacters (such as semicolons, vertical bars, backticks, or $(cmd), etc.) into the `channel` parameter, causing operating system commands to be appended to the “ptest setchannel” command and executed together. Once the command injection is successful, an attacker can execute arbitrary operating system commands on the target device with system privileges, thereby gaining complete control over the device’s behavior, including but not limited to modifying system configurations, implanting malicious programs, establishing a reverse shell, or causing permanent damage to the device.
Source⚠️ https://github.com/AdminSafe/CVE/issues/6
User
 010hex (UID 99386)
Submission07/05/2026 16:45 (2 months ago)
Moderation08/20/2026 10:39 (2 months later)
StatusDuplicate
VulDB entry346123 [Comfast CF-N1 V2 2.6.0.2 mbox-config?method=SET§ion=ptest_channel sub_44AB9C command injection]
Points0

Want to stay up to date on a daily basis?

Enable the mail alert feature now!