CVE-2026-3798
Remote Command Injection in Comfast CF-AC100 Request Handler
Publication date: 2026-03-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| comfast | cf-ac100_firmware | 2.6.0.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3798 is a command injection vulnerability in the COMFAST CF-AC100 router firmware version 2.6.0.8. It affects the function sub_44AC14 within the web management component, specifically at the endpoint /cgi-bin/mbox-config?method=SET§ion=ping_config.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the 'destination' parameter from an HTTP POST request is not properly sanitized before being concatenated into a system command and executed. This allows an authenticated attacker with valid session cookies to inject arbitrary system commands remotely."}, {'type': 'paragraph', 'content': 'A proof-of-concept exploit demonstrates how an attacker can send a specially crafted POST request to execute commands such as creating a named pipe and establishing a reverse shell, effectively gaining remote code execution with the privileges of the web management process.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely execute arbitrary commands on the affected device, which can compromise the confidentiality, integrity, and availability of the router.
- Remote code execution with web management process privileges.
- Potential unauthorized control over the device, including creating reverse shells for persistent access.
- Disruption or manipulation of network traffic passing through the compromised router.
- Increased risk of further attacks on the internal network due to compromised device.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for specially crafted HTTP POST requests sent to the endpoint `/cgi-bin/mbox-config?method=SET§ion=ping_config` on Comfast CF-AC100 devices running firmware version 2.6.0.8.'}, {'type': 'paragraph', 'content': 'Detection commands could include capturing and inspecting HTTP traffic for POST requests targeting this specific path with suspicious payloads in the `destination` parameter that may contain shell command injection attempts.'}, {'type': 'list_item', 'content': 'Use network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to `/cgi-bin/mbox-config?method=SET§ion=ping_config`.'}, {'type': 'list_item', 'content': "Example tcpdump command: `tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/cgi-bin/mbox-config?method=SET§ion=ping_config'`"}, {'type': 'list_item', 'content': 'Inspect web server logs on the device for POST requests to the vulnerable endpoint containing suspicious or unusual `destination` parameter values.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the vulnerable endpoint and ensuring only trusted and authenticated users can reach the device's web management interface."}, {'type': 'paragraph', 'content': 'Since no vendor patch or official fix is available, it is recommended to disable remote management or restrict it to trusted networks only.'}, {'type': 'paragraph', 'content': 'Replacing the affected device with a non-vulnerable model or firmware version is suggested as a long-term mitigation.'}, {'type': 'paragraph', 'content': "Monitoring for exploitation attempts and applying network-level protections such as firewall rules to block unauthorized access to the device's management interface can reduce risk."}] [3]