A remotely exploitable stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) carries a maximum CVSS score of 10.0 and requires no authentication or user interaction.
What Is It
The flaw sits in the get_para_from_uri function within /cgi-bin/mbox-config, part of the device's URI Parameter Parsing component. An attacker who manipulates the width and height arguments can trigger a stack-based buffer overflow. The attack can be initiated remotely.
VulDB, the assigning CNA, classifies the issue as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow). The record was published 2026-08-19 and currently sits in NVD's "Received" status, meaning NVD has not yet run its own analysis and has not independently confirmed the weakness classification or the scoring below.
Why It Matters
Both CVSS v3.1 and CVSS v4.0 rate this at 10.0 / CRITICAL. The v3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, describes the worst realistic profile for an embedded device: network-reachable, low complexity, no privileges, no user interaction, with a changed scope and high impact across confidentiality, integrity, and availability. The CVSS v4.0 scoring likewise marks all subsequent-system impacts as HIGH, indicating consequences that reach beyond the vulnerable component itself.
Stack overflows in CGI handlers on network gear are a well-worn path to remote code execution, and the parsing routine here is reachable over the network without credentials.
What's Vulnerable
- Vendor: Comfast
- Product: CF-N1-S
- Affected version: 2.6.0.1
- Component: URI Parameter Parsing
- Affected file/function:
/cgi-bin/mbox-config,get_para_from_uri - CPE:
cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
No other versions or models are listed as affected in the supplied data.
Patch Status
The supplied source material lists no vendor patch, fixed version, or mitigation guidance. CVE-2026-76008 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation and no federally mandated remediation deadline associated with it. Exploit maturity in the CVSS v4.0 vector is NOT_DEFINED.
A public reference points to a third-party research repository (1ChaoRen1/IOT_3) associated with the disclosure. Operators running CF-N1-S 2.6.0.1 should assume the device is exposed until the vendor ships a fix, and restrict management interface reachability accordingly.
Sources
- NVD, CVE-2026-76008: https://nvd.nist.gov/vuln/detail/CVE-2026-76008
- VulDB, CVE-2026-76008: https://vuldb.com/cve/CVE-2026-76008
- VulDB, Vulnerability 391922: https://vuldb.com/vuln/391922
- VulDB, CTI Data: https://vuldb.com/vuln/391922/cti
- VulDB, Submission 878007: https://vuldb.com/submit/878007
- Researcher repository: https://github.com/1ChaoRen1/IOT_3
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog