Medium severity · published Aug 17, 2026
CVE-2026-19976
COMFAST CF-N1-S mbox-config sub_44A968 command injection
6.6
CVSS
2.9%
EPSS
No
On KEV
Description
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
CF-N1-S · COMFAST
2.6.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19976
github.com
https://github.com/1ChaoRen1/IOT/blob/main/CF-N1-S-V2.6.0.1%20.pdf
vuldb.com
https://vuldb.com/cve/CVE-2026-19976
vuldb.com
https://vuldb.com/submit/873821
vuldb.com
https://vuldb.com/vuln/391155
vuldb.com
https://vuldb.com/vuln/391155/cti
More from CF-N1-S
10.0
CVE-2026-94003
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
10.0
CVE-2026-76008
Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
9.9
CVE-2026-78050
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
9.9
CVE-2026-77683
Comfast CF-N1-S mbox-config system command injection
9.9
CVE-2026-77148
Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow