TI-2026-63261 CVE-2026-94003 · GHSA-w3j5-9v4x-w7pw
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
Priority HIGH 82
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1.
Comfast
Records37All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical15CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Comfast records in CISA KEVNo Comfast vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
37 records
TI-2024-29900 CVE-2024-44466 · GHSA-p9p3-pvmx-pxrh
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.
Priority HIGH 82
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.
TI-2023-20142 CVE-2023-38866 · GHSA-pgc3-2rm3-6fq4
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function…
Priority HIGH 82
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588.
TI-2023-20141 CVE-2023-38865 · GHSA-29cr-mj24-pqgh
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function…
Priority HIGH 82
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0.
TI-2023-20140 CVE-2023-38864 · GHSA-hfvw-6p69-w45c
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the…
Priority HIGH 82
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
TI-2023-20139 CVE-2023-38863 · GHSA-3qw9-7wg6-qff3
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the…
Priority HIGH 82
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.
TI-2023-20138 CVE-2023-38862 · GHSA-wm2c-859g-3w93
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the…
Priority HIGH 82
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt.
TI-2026-13050 CVE-2026-15511 · GHSA-hpmx-855m-f9m5
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
Priority HIGH 81
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8.
TI-2026-54291 CVE-2026-78050 · GHSA-j397-vxh8-xhw3
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
Priority HIGH 76
A vulnerability was found in Comfast CF-N1-S 2.6.0.1.
TI-2026-54127 CVE-2026-77683 · GHSA-hh37-xhg2-x62w
Comfast CF-N1-S mbox-config system command injection
Priority HIGH 76
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.
TI-2026-53891 CVE-2026-77148 · GHSA-j7x2-7p87-73vg
Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow
Priority HIGH 76
A vulnerability was found in Comfast CF-N1-S 2.6.0.1.
TI-2026-53806 CVE-2026-77022 · GHSA-5pr4-rqrw-x9qc
Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow
Priority HIGH 76
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.
TI-2026-52762 CVE-2026-75094 · GHSA-qp57-ch36-236j
COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
Priority HIGH 76
A flaw has been found in COMFAST CF-N1-S 2.6.0.1.
TI-2025-35499 CVE-2025-57293 · GHSA-6x44-8387-hrwg
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the…
Priority HIGH 73
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt.
TI-2022-22575 CVE-2022-45725 · GHSA-368j-g93f-6hjp
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on…
Priority HIGH 73
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request
TI-2025-08779 CVE-2025-9586 · GHSA-gv2q-6f6j-9cc8
Comfast CF-N1 webmgnt wireless_device_dissoc command injection
Priority HIGH 65
A vulnerability was identified in Comfast CF-N1 2.6.0.
TI-2025-08778 CVE-2025-9585 · GHSA-c3wp-c723-c74r
Comfast CF-N1 webmgnt wifilith_delete_pic_file command injection
Priority HIGH 65
A vulnerability was determined in Comfast CF-N1 2.6.0.
TI-2025-08777 CVE-2025-9584 · GHSA-rrxw-5cf7-7mpx
Comfast CF-N1 webmgnt update_interface_png command injection
Priority HIGH 65
A vulnerability was found in Comfast CF-N1 2.6.0.
TI-2025-08776 CVE-2025-9583 · GHSA-jmhh-xhqp-9cqc
Comfast CF-N1 webmgnt ping_config command injection
Priority HIGH 65
A vulnerability has been found in Comfast CF-N1 2.6.0.
TI-2022-22574 CVE-2022-45724 · GHSA-25rm-p4h5-753p
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on…
Priority MEDIUM 58
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using thi…
TI-2026-53790 CVE-2026-77004 · GHSA-m27q-v5c6-r932
Comfast CF-N1-S mbox-config sprintf command injection
Priority MEDIUM 57
A flaw has been found in Comfast CF-N1-S 2.6.0.1.
TI-2026-10952 CVE-2026-12814 · GHSA-fvx9-6cqj-p3f8
Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
Priority MEDIUM 57
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8.
TI-2026-02426 CVE-2026-2824 · GHSA-5fgx-x2mx-c652
Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection
Priority MEDIUM 57
A flaw has been found in Comfast CF-E7 2.6.0.9.
TI-2026-02425 CVE-2026-2823 · GHSA-6wwj-pg79-rf37
Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
Priority MEDIUM 57
A vulnerability was detected in Comfast CF-E7 2.6.0.9.
TI-2026-02161 CVE-2026-2535 · GHSA-7364-56q4-9jv8
Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
Priority MEDIUM 57
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2.