CVE-2026-77148
Received Received - Intake

Stack-Based Buffer Overflow in Comfast CF-N1-S Web Management

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77148
EUVD
EUVD-2026-63573

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
comfast cf-n1-s 2.6.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the Comfast CF-N1-S router version 2.6.0.1. It occurs in the sub_44B50C function when processing the channel parameter in HTTP POST requests to the /cgi-bin/mbox-config endpoint. The function uses an unsafe sprintf-like operation to concatenate the channel value into a 64-byte stack buffer without proper length validation. When the channel value exceeds this buffer size, it overwrites critical stack data, including the return address, enabling arbitrary code execution with the web service's privileges.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP POST requests to the /cgi-bin/mbox-config endpoint with the section=ptest_channel parameter. Look for unusually long channel parameter values in JSON payloads that may exceed 64 bytes. Check router logs for crashes or unexpected behavior after such requests.

Impact Analysis

This vulnerability allows an authenticated attacker to execute arbitrary code on the affected router. This could lead to full device compromise, giving the attacker control over the router's functions. An attacker could exploit this to intercept network traffic, modify router settings, or launch further attacks within the local network.

Compliance Impact

This vulnerability could lead to unauthorized code execution on the device, potentially allowing attackers to access, modify, or exfiltrate sensitive data. For GDPR, this may result in unauthorized data processing or breaches, requiring notifications under Article 33. For HIPAA, it could compromise protected health information, violating integrity and confidentiality requirements.

Mitigation Strategies

Immediately update the Comfast CF-N1-S router firmware to the latest version if an update is available. Disable remote access to the web management interface if not required. Block or restrict access to the /cgi-bin/mbox-config endpoint via firewall rules. Monitor for suspicious activity and consider isolating affected devices from critical network segments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart