Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 18

Export CSV
CVE-2026-76008

Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.

CVSS 4.0 · 10 Critical EPSS 1.0% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-77004

Comfast CF-N1-S mbox-config sprintf command injection

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2025-9584

Comfast CF-N1 webmgnt update_interface_png command injection

A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of the argument interface/display_name results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2025-9583

Comfast CF-N1 webmgnt ping_config command injection

A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2026-94003

Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-78050

Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-77022

Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-77683

Comfast CF-N1-S mbox-config system command injection

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS 2.9% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-77148

Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-19976

COMFAST CF-N1-S mbox-config sub_44A968 command injection

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS 2.9% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-75094

COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.2% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-6799

Comfast CF-N1-S Endpoint mbox-config command injection

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Comfast
Products
Cf-n1-s
CVE-2026-2534

Comfast CF-N1 V2 mbox-config sub_44AC4C command injection

A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 15.0% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2026-2535

Comfast CF-N1 V2 mbox-config sub_44AB9C command injection

A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 15.6% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2025-9585

Comfast CF-N1 webmgnt wifilith_delete_pic_file command injection

A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2025-9586

Comfast CF-N1 webmgnt wireless_device_dissoc command injection

A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2025-9581

Comfast CF-N1 webmgnt multi_pppoe command injection

A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS 4.0 · 5.3 Medium EPSS 4.8% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware
CVE-2025-9582

Comfast CF-N1 webmgnt ntp_timezone command injection

A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS 4.8% KEV · Not listed
Vendors
Comfast
Products
Cf-n1 Cf-n1 Firmware