Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-4466 is a command injection vulnerability in the COMFAST CF-AC100 router running firmware version 2.6.0.8. It occurs in the web management interface at the endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone, specifically in the handling of the "timestr" field in an HTTP POST request.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the "timestr" parameter is not properly validated and is unsafely concatenated using sprintf before being executed via a system call. This allows an authenticated attacker with valid session cookies to inject arbitrary shell commands remotely.'}, {'type': 'paragraph', 'content': 'By sending a crafted POST request with malicious payload in the "timestr" JSON parameter, the attacker can execute arbitrary commands on the device, such as opening a reverse shell to an attacker-controlled server.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated remote attacker to execute arbitrary system commands on the affected COMFAST CF-AC100 router. This can lead to full compromise of the device.

• Unauthorized control over the router, potentially allowing attackers to change configurations or disrupt network operations.
• Execution of malicious commands such as opening reverse shells, which can be used to gain persistent access or pivot to other devices on the network.
• Potential interception or manipulation of network traffic passing through the compromised router.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for unauthorized or suspicious POST requests to the endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone on the COMFAST CF-AC100 router running firmware version 2.6.0.8.'}, {'type': 'paragraph', 'content': 'Specifically, monitoring HTTP POST requests that include the "timestr" parameter in the JSON body is important, as this parameter is vulnerable to command injection if it contains malicious payloads.'}, {'type': 'paragraph', 'content': 'Detection commands could include using network traffic analysis tools like tcpdump or Wireshark to filter for POST requests to the vulnerable endpoint, for example:'}, {'type': 'list_item', 'content': "tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/cgi-bin/mbox-config?method=SET&section=ntp_timezone'"}, {'type': 'paragraph', 'content': 'Additionally, inspecting web server logs for POST requests to this endpoint with suspicious "timestr" values can help identify exploitation attempts.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the web management interface of the COMFAST CF-AC100 router to trusted and authenticated users only.'}, {'type': 'paragraph', 'content': 'Since exploitation requires authentication and valid session cookies, ensuring strong authentication mechanisms and session management can reduce risk.'}, {'type': 'paragraph', 'content': "Avoid exposing the router's management interface to untrusted networks or the internet."}, {'type': 'paragraph', 'content': 'If possible, disable or restrict the vulnerable endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone until a patch or firmware update is available.'}, {'type': 'paragraph', 'content': 'Monitor network traffic and logs for suspicious activity targeting this endpoint.'}] [1]

Useful 0 Not Useful 0