Medium severity · published Apr 21, 2026
CVE-2026-6799
Comfast CF-N1-S Endpoint mbox-config command injection
6.3
CVSS
1.9%
EPSS
No
On KEV
Description
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
CF-N1-S · Comfast
2.6.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6799
github.com
https://github.com/Blackhole23-Lab/-/blob/main/Comfast-CF-N1-S-Router-VUDB.md
vuldb.com
https://vuldb.com/submit/795203
vuldb.com
https://vuldb.com/vuln/358492
vuldb.com
https://vuldb.com/vuln/358492/cti
More from CF-N1-S
10.0
CVE-2026-94003
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
10.0
CVE-2026-76008
Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
9.9
CVE-2026-78050
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
9.9
CVE-2026-77683
Comfast CF-N1-S mbox-config system command injection
9.9
CVE-2026-77148
Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow