CF-E4 vulnerabilities

1 known vulnerability in CF-E4 from Comfast. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  CF-E4: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2537Feb 16, 2026ComfastEPSS 28%

  A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command in