Chaorenchaojiwudi

**Name of the Vulnerable Software and Affected Versions** Comfast CF-N1-S version 2.6.0.1 **Description** A remote attack is possible due to a stack-based buffer overflow in the URI Parameter Parsing component. The issue occurs within the `get para from uri()` function located in the `/cgi-bin/mbox-config` endpoint when the `width` or `height` arguments are manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/cgi-bin/mbox-config` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** COMFAST CF-N1-S version 2.6.0.1 **Description** An OS command injection flaw exists in the CGI Interface component. The issue occurs within the `sub 44B438()` function of the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint. Remote exploitation is possible by manipulating the `ssid` argument, allowing an attacker to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `ssid` argument in the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** COMFAST CF-N1-S version 2.6.0.1 **Description** A command injection flaw exists that allows remote attackers to execute arbitrary commands. The issue occurs within the `sub 44A968()` function of the '/cgi-bin/mbox-config' endpoint when the `macaddress` variable is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `macaddress` parameter in the '/cgi-bin/mbox-config' endpoint to minimize the risk of exploitation.