CVE-2026-2824

Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

State: Published
Severity: 5.3 Medium
Published: Feb 20, 2026
Updated: Feb 23, 2026
Reserved: Feb 19, 2026

Description

A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
CF-E7Comfast	2.6.0.9Affected

References

VDB-346949 | Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injectionvdb-entrytechnical-description
VDB-346949 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #753878 | ComFast Comfast CF-E7 V2.6.0.9 Command Injectionthird-party-advisory
https://github.com/jinhao118/cve/blob/main/ComFast%20Router_4.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.