Cpe:2.3:a:comfast:cf_n1_s:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acomfastcf_n1_s/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 20 Sep 2026 12:20:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Stack-Based Buffer Overflow in Comfast CF-N1-Shttps://feed.craftedsignal.io/briefs/2026-09-comfast-buffer-overflow/Sun, 20 Sep 2026 12:20:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-comfast-buffer-overflow/A stack-based buffer overflow vulnerability in the Comfast CF-N1-S Web Management Interface (CVE-2026-94003) allows remote, unauthenticated attackers to execute arbitrary code via a malicious URI request.A critical stack-based buffer overflow vulnerability, identified as CVE-2026-94003, affects the Web Management Interface of Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists within the get_css_path_from_uri function located in the /cgi-bin/mbox-config script. Because this endpoint is accessible via the web interface and does not require authentication, a remote attacker can trigger the overflow by sending a specially crafted HTTP request. The vulnerability is publicly disclosed, and proof-of-concept exploits exist, posing a high risk for full device compromise, remote code execution, or persistent denial of service. Defenders should prioritize restricting access to the management interface of these devices from untrusted networks.

Impact

Successful exploitation allows for unauthenticated remote code execution with root-level privileges on the affected CF-N1-S devices. Given the nature of the vulnerability, the entire device can be fully compromised, leading to complete loss of confidentiality, integrity, and availability. This is particularly critical for networking hardware that may reside at the edge of corporate or residential networks.

Recommendation

  • Restrict network access to the Web Management Interface of all Comfast CF-N1-S devices to authorized management VLANs or VPNs only.
  • Monitor web server access logs for anomalous, excessively long, or malformed GET/POST requests targeted at /cgi-bin/mbox-config.
  • Ensure perimeter firewalls block unsolicited inbound traffic to the web management ports (typically 80/443) of networking equipment from the public internet.
]]>criticaladvisoryvulnerabilityremote-code-executionnetwork-infrastructure