CF-N1-S vulnerabilities

8 known vulnerabilities in CF-N1-S from Comfast. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-94003Sep 20, 2026Comfast

  A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initi

• 9.9 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-78050Aug 23, 2026Comfast

  A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled

• 9.9 Critical severity

  CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-77683Aug 21, 2026ComfastEPSS 2.89%

  A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack ca

• 9.9 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-77148Aug 20, 2026Comfast

  A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack ca

• 9.9 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-77022Aug 20, 2026Comfast

  A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results

• 7.4 High severity

  CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-77004Aug 20, 2026ComfastEPSS 1.77%

  A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. Th

• 10.0 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-76008Aug 19, 2026ComfastEPSS 1.02%

  A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack

• 9.1 Critical severity

  CF-N1-S: Improper Neutralization of Special Elements used in a Command

  CVE-2026-75094Aug 18, 2026ComfastEPSS 3.18%

  A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exp