Critical severity · published Aug 18, 2026
CVE-2026-75094
COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
9.1
CVSS
3.2%
EPSS
No
On KEV
Description
A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
CF-N1-S · COMFAST
2.6.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75094
github.com
https://github.com/1ChaoRen1/IOT_1
vuldb.com
https://vuldb.com/cve/CVE-2026-75094
vuldb.com
https://vuldb.com/submit/877482
vuldb.com
https://vuldb.com/vuln/391346
vuldb.com
https://vuldb.com/vuln/391346/cti
More from CF-N1-S
10.0
CVE-2026-94003
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
10.0
CVE-2026-76008
Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
9.9
CVE-2026-78050
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
9.9
CVE-2026-77683
Comfast CF-N1-S mbox-config system command injection
9.9
CVE-2026-77148
Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow