CVE-2026-77683

Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1

Description A remote command injection flaw exists in the system() function within the /cgi-bin/mbox-config?method=SET&section=ntp timezone endpoint. This occurs when the timestr argument is manipulated, allowing an attacker to execute arbitrary commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the timestr parameter in the /cgi-bin/mbox-config?method=SET&section=ntp timezone endpoint until the issue is resolved.