Skip to content
OpenAdvisories

Vendor

Comfast

28 known vulnerabilities.

Products

CF-N1-S 10 CF-N1 6 CF-AC100 4 CF-E7 2 CF-WR631AX V3 2 CF-N1 V2 2 CF-WR632AX 1 CF-E4 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-122013

    Comfast CF-WR632AX Multipart webmgnt path traversal

    A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal…

    Comfast CF-WR632AX
  • Critical 10.0
    CVE-2026-94003

    Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow

    A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be init…

    Comfast CF-N1-S
  • Critical 9.9
    CVE-2026-78050

    Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow

    A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled…

    Comfast CF-N1-S
  • Critical 9.9
    CVE-2026-77683

    Comfast CF-N1-S mbox-config system command injection

    A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack c…

    Comfast CF-N1-S
  • Critical 9.9
    CVE-2026-77148

    Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

    A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack c…

    Comfast CF-N1-S
  • Critical 9.9
    CVE-2026-77022

    Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

    A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results…

    Comfast CF-N1-S
  • Critical 10.0
    CVE-2026-76008

    Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

    A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attac…

    Comfast CF-N1-S
  • Critical 9.1
    CVE-2026-75094

    COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

    A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote ex…

    Comfast CF-N1-S
  • Critical 9.8
    CVE-2026-15511

    Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

    A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os…

    Comfast CF-WR631AX V3