SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-75094 2026-08-18

CVE-2026-75094: OS Command Injection in COMFAST CF-N1-S CGI Interface

"A published proof-of-concept exploit targets an OS command injection flaw in the COMFAST CF-N1-S 2.6.0.1 CGI interface, allowing remote attackers with high privileges to execute arbitrary commands with full compromise…"

A published proof-of-concept exploit targets an OS command injection flaw in the COMFAST CF-N1-S 2.6.0.1 CGI interface, allowing remote attackers with high privileges to execute arbitrary commands with full compromise of confidentiality, integrity, and availability.

What Is It

CVE-2026-75094 is an OS command injection vulnerability (CWE-77 / CWE-78) in COMFAST CF-N1-S firmware version 2.6.0.1. The flaw resides in the function sub_44B438 handling /cgi-bin/mbox-config?method=SET&section=ptest_ssid within the device's CGI Interface component. Manipulation of the ssid argument causes operating system command injection, and remote exploitation is possible.

Why It Matters

The CVSS v3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The attack is network-reachable with low complexity and requires no user interaction, though high privileges are required. The scope is marked as Changed, meaning successful exploitation impacts resources beyond the vulnerable component itself; consistent with command execution on the underlying operating system. A separate CVSS v4.0 assessment scores the issue 8.5 (HIGH).

Critically, the exploit has been published and may be used. The CVSS v4.0 assessment assigns an exploit maturity of PROOF_OF_CONCEPT, and a proof-of-concept repository is publicly referenced; this indicates demonstration code is available rather than confirming a reliable, weaponized exploit. Even so, public exploit availability lowers the barrier for opportunistic attackers scanning for exposed devices.

The sources reviewed for this brief carry no CISA KEV catalog data for this CVE either way, so its KEV status is unverified here and no conclusion should be drawn about confirmed in-the-wild exploitation.

What's Vulnerable

Patch Status

The supplied NVD record does not identify a vendor patch, fixed version, or mitigation guidance. The CVE was published 2026-08-18 with a vulnerability status of Received, meaning NVD analysis is not yet complete. The records reviewed here also contain no required-action or remediation-deadline data. Organizations operating affected devices should restrict network access to the CGI management interface pending vendor guidance.

Sources