Submit #881293: Comfast CF-N1-S V2.6.0.1 Buffer Overflow

A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router, specifically in the `sub_41AD7C` function. This function processes the HTTP request `/cgi-bin/mbox-config`, and the relevant logic is triggered when `method=SET` and `section=ntp_timezone`.

After successful authentication, an attacker can send a specially crafted HTTP POST request to the target device by constructing a valid session, thereby entering the NTP time zone configuration processing flow. Triggering this vulnerability requires two conditions to be met simultaneously: the request body must contain the `timestr` field, and the value of the `ntp_client_enabled` field must be `“0”`. Both values are directly extracted from the request body and are fully controllable by the attacker.

In the vulnerability execution path, the user-controlled parameter `timestr` is passed to the `off_47D1FC` (`sprintf`) function, formatted according to the format string `&aDateSSDevNull` (corresponding to `“date -s \”%s\“ > /dev/null”`), and ultimately written to the fixed-size stack buffer `v10`.

Since this write operation does not perform any valid length restrictions or boundary checks on the input, a stack buffer overflow occurs when the length of the `timestr` parameter exceeds the buffer’s capacity.

An attacker can precisely control the length and content of `timestr` to corrupt the current function’s stack frame structure, ultimately causing the program to crash and, under specific conditions, potentially leading to a controllable control flow hijacking risk.

• Source: ⚠️ https://github.com/AdminSafe/CVE/issues/9
• User: 010hex (UID 99386)
• Submission: 07/06/2026 15:24 (2 months ago)
• Moderation: 08/22/2026 10:08 (2 months later)
• Status: Accepted
• VulDB entry: 394291 [Comfast CF-N1-S 2.6.0.1 Web Management mbox-config?method=SET§ion=ntp_timezone sub_41AD7C timestr/ntp_client_enabled stack-based overflow]
• Points: 20