CVE-2026-75094

Name of the Vulnerable Software and Affected Versions COMFAST CF-N1-S version 2.6.0.1

Description An OS command injection flaw exists in the CGI Interface component. The issue occurs within the sub 44B438() function of the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint. Remote exploitation is possible by manipulating the ssid argument, allowing an attacker to execute arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the ssid argument in the '/cgi-bin/mbox-config?method=SET&section=ptest ssid' endpoint until the issue is resolved.