CVE-2026-4467
Received Received - Intake
Remote Command Injection in Comfast CF-AC100 Wireless Config CGI

Publication date: 2026-03-20

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc. The manipulation results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-4467
EUVD
EUVD-2026-13515
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
comfast cf-ac100 2.6.0.8
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc on the Comfast CF-AC100 device and observing if arbitrary commands can be executed.'}, {'type': 'paragraph', 'content': 'A sample detection command using curl would be:'}, {'type': 'list_item', 'content': 'curl -X POST http://<device-ip>/cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc -H "Content-Type: application/json" -H "Cookie: language=sc; COMFAST_SESSIONID=<session-id>" -d \'{"ifname": "127.0.0.1", "mac": "; echo wireless_device_dissoc > /tmp/1.txt #"}\''}, {'type': 'paragraph', 'content': "If the command injection is successful, the device will execute the injected command, for example creating a file /tmp/1.txt with the content 'wireless_device_dissoc'. Checking for the presence of this file or other side effects can confirm the vulnerability."}] [1]

Executive Summary

[{'type': 'paragraph', 'content': 'The COMFAST CF-AC100 router firmware version 2.6.0.8 contains a command injection vulnerability in its web management interface. Specifically, the vulnerability exists in the handling of the "mac" field in HTTP POST requests to the endpoint /cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc. The input from this field is not properly validated and is unsafely concatenated and executed by the system, allowing an attacker to inject and execute arbitrary commands on the device remotely.'}, {'type': 'paragraph', 'content': 'An attacker can exploit this by sending a specially crafted HTTP POST request with malicious commands embedded in the "mac" parameter, which the device then executes. This can lead to unauthorized control over the device.'}] [1]

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary system commands on the affected device. This can lead to unauthorized access, control, and manipulation of the device, potentially compromising the network it is connected to.

  • Attackers could disrupt device functionality or network operations.
  • Sensitive information on the device or network could be exposed or altered.
  • The device could be used as a foothold for further attacks within the network.
Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart