A publicly disclosed stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets a remote, low-privileged attacker corrupt memory through the SSID configuration handler, with a public exploit already released.
What Is It
The flaw sits in the function sub_44B438, reached via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ptest_ssid in the SSID Configuration component. Manipulating the ssid argument results in a stack-based buffer overflow. The issue is tracked under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow), and was assigned by VulDB as the CNA.
Why It Matters
NVD lists a CVSS v3.1 base score of 9.9 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network-reachable attack, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The secondary CVSS v4.0 score is 8.6 (HIGH) with an exploit maturity of Proof-of-Concept, and the CVSS v2 score is 9.0.
The attack can be executed remotely, and per the NVD description the exploit "has been released to the public and may be used for attacks." A public issue tracker entry (AdminSafe/CVE issue #5) is referenced as a source. This CVE does not currently appear in the CISA KEV catalog, so there is no confirmed evidence of active in-the-wild exploitation at this time, but public exploit availability meaningfully lowers the bar for opportunistic attacks against exposed devices.
Note that exploitation requires low privileges (PR:L), so the practical risk concentrates on devices with weak, default, or widely known credentials, or where the management interface is reachable from untrusted networks.
What's Vulnerable
- Vendor: Comfast
- Product: CF-N1-S
- Version: 2.6.0.1 (affected)
- Component: SSID Configuration
- CPE:
cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Patch Status
No vendor patch, fixed version, or remediation guidance is present in the supplied NVD record. There is no CISA KEV entry and therefore no mandated due date or required action. Until vendor guidance appears, restricting network access to the device's management interface is the only mitigation supported by the available data.