CVE-2026-6799

MEDIUM

Comfast CF-N1-S Endpoint mbox-config command injection

Title source: cna

Description

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358492 | Comfast CF-N1-S Endpoint mbox-config command injection

https://vuldb.com/vuln/358492

Signature, Permissions Required signature permissions-required

VDB-358492 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/358492/cti

Third Party Advisory third-party-advisory

Submit #795203 | Comfast CF-N1-S V2.6.0.1 Authenticated Command Injection

https://vuldb.com/submit/795203

Exploit exploit

https://github.com/Blackhole23-Lab/-/blob/main/Comfast-CF-N1-S-Router-VUDB.md

View Exploit ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0118

EPSS Percentile 63.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-77

Status published

Products (1)

Comfast/CF-N1-S 2.6.0.1

Published Apr 21, 2026

Tracked Since Apr 22, 2026