CVE-2026-19976
COMFAST CF-N1-S mbox-config sub_44A968 command injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Aug 17, 2026
- Updated
- Aug 17, 2026
- Reserved
- Aug 16, 2026
Description
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P | VulDB |
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.6 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CF-N1-SCOMFAST |
|
References
- VDB-391155 | COMFAST CF-N1-S mbox-config sub_44A968 command injectionvdb-entrytechnical-description
- VDB-391155 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-19976 | CVE Analysis and Reportthird-party-advisory
- Submit #873821 | Comfast CF-N1-S V2.6.0.1 Command Injectionthird-party-advisory
- https://github.com/1ChaoRen1/IOT/blob/main/CF-N1-S-V2.6.0.1%20.pdfexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.