CVE-2026-4468
Remote Command Injection in Comfast CF-AC100 via mbox-config CGI
Publication date: 2026-03-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| comfast | cf-ac100 | 2.6.0.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary system commands on the affected COMFAST CF-AC100 device. This can lead to unauthorized control over the device, enabling attackers to manipulate device settings, install malware, disrupt network operations, or use the device as a foothold for further attacks within the network.
Because the exploit can be carried out remotely and requires only valid user session cookies, it poses a significant security risk, potentially compromising the confidentiality, integrity, and availability of the device and connected network.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-4468 is a command injection vulnerability found in the COMFAST CF-AC100 router firmware version 2.6.0.8. It occurs in a function handling HTTP POST requests to the path /cgi-bin/mbox-config?method=SET§ion=update_interface_png. Specifically, the parameters 'interface' and 'display_name' are not properly validated or sanitized before being used in a system call, allowing an attacker to inject and execute arbitrary shell commands on the device."}, {'type': 'paragraph', 'content': "Exploitation requires sending a specially crafted HTTP POST request with malicious input in these parameters. The vulnerability requires user login and session cookies but can be exploited remotely. A proof-of-concept demonstrates that commands like 'echo test > /tmp/test.txt' can be executed on the device, showing the ability to run arbitrary commands."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for HTTP POST requests sent to the path /cgi-bin/mbox-config?method=SET§ion=update_interface_png on the Comfast CF-AC100 device.'}, {'type': 'paragraph', 'content': 'Specifically, look for POST requests containing suspicious payloads in the parameters "interface" and "display_name" that attempt to inject shell commands.'}, {'type': 'paragraph', 'content': 'An example detection command using curl to test for the vulnerability is:'}, {'type': 'list_item', 'content': 'curl -X POST http://<device-ip>/cgi-bin/mbox-config?method=SET§ion=update_interface_png -H "Content-Type: application/json" -H "Cookie: COMFAST_SESSIONID=<session-id>" -d \'{"interface":" ; echo test > /tmp/test.txt # ", "display_name":"1111"}\''}, {'type': 'paragraph', 'content': 'If the file /tmp/test.txt is created on the device, it indicates the device is vulnerable to command injection.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the affected device's web interface to trusted networks only."}, {'type': 'paragraph', 'content': 'Ensure that only authorized users with valid session cookies can access the vulnerable endpoint.'}, {'type': 'paragraph', 'content': 'Monitor and block suspicious HTTP POST requests targeting /cgi-bin/mbox-config?method=SET§ion=update_interface_png.'}, {'type': 'paragraph', 'content': 'Since the vendor has not responded with a patch, consider isolating the device from untrusted networks until a fix or firmware update is available.'}] [1]