PT-2026-76903
CVE-2026-75094
·
Published
2026-08-18
·
Updated
2026-10-22
Description by
CVSS 3.1
9.1
CriticalMetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
COMFAST CF-N1-S version 2.6.0.1
Description
An OS command injection flaw exists in the CGI Interface component. The issue occurs within the
sub 44B438() function of the '/cgi-bin/mbox-config?method=SET§ion=ptest ssid' endpoint. Remote exploitation is possible by manipulating the ssid argument, allowing an attacker to execute arbitrary operating system commands.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Avoid using the
ssid argument in the '/cgi-bin/mbox-config?method=SET§ion=ptest ssid' endpoint until the issue is resolved.Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾