CVE-2026-4467
Remote Command Injection in Comfast CF-AC100 Wireless Config CGI
Publication date: 2026-03-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| comfast | cf-ac100 | 2.6.0.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /cgi-bin/mbox-config?method=SET§ion=wireless_device_dissoc on the Comfast CF-AC100 device and observing if arbitrary commands can be executed.'}, {'type': 'paragraph', 'content': 'A sample detection command using curl would be:'}, {'type': 'list_item', 'content': 'curl -X POST http://<device-ip>/cgi-bin/mbox-config?method=SET§ion=wireless_device_dissoc -H "Content-Type: application/json" -H "Cookie: language=sc; COMFAST_SESSIONID=<session-id>" -d \'{"ifname": "127.0.0.1", "mac": "; echo wireless_device_dissoc > /tmp/1.txt #"}\''}, {'type': 'paragraph', 'content': "If the command injection is successful, the device will execute the injected command, for example creating a file /tmp/1.txt with the content 'wireless_device_dissoc'. Checking for the presence of this file or other side effects can confirm the vulnerability."}] [1]
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The COMFAST CF-AC100 router firmware version 2.6.0.8 contains a command injection vulnerability in its web management interface. Specifically, the vulnerability exists in the handling of the "mac" field in HTTP POST requests to the endpoint /cgi-bin/mbox-config?method=SET§ion=wireless_device_dissoc. The input from this field is not properly validated and is unsafely concatenated and executed by the system, allowing an attacker to inject and execute arbitrary commands on the device remotely.'}, {'type': 'paragraph', 'content': 'An attacker can exploit this by sending a specially crafted HTTP POST request with malicious commands embedded in the "mac" parameter, which the device then executes. This can lead to unauthorized control over the device.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary system commands on the affected device. This can lead to unauthorized access, control, and manipulation of the device, potentially compromising the network it is connected to.
- Attackers could disrupt device functionality or network operations.
- Sensitive information on the device or network could be exposed or altered.
- The device could be used as a foothold for further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know