A publicly disclosed command injection flaw in Comfast CF-N1-S 2.6.0.1 lets a remote, low-privileged attacker execute arbitrary commands through the device's NTP timezone configuration endpoint.
What Is It
CVE-2026-77683 is a command injection vulnerability (CWE-77, CWE-74) in the Comfast CF-N1-S firmware version 2.6.0.1. The flaw sits in the system function reachable via /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulating the timestr argument allows attacker-supplied input to reach command execution. The attack can be launched remotely over the network, requires low privileges, and needs no user interaction.
NVD carries a primary base score of 9.9 (CRITICAL) under CVSS 3.1; vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, note the changed scope, which reflects impact beyond the vulnerable component itself. A secondary CVSS 4.0 score of 8.6 (HIGH) is also recorded, with exploit maturity rated Proof-of-Concept.
Why It Matters
The exploit has been released publicly, which lowers the effort required to weaponize the flaw. Combined with network-reachable attack surface, low attack complexity, and no user interaction requirement, this fits the profile of a bug that is often folded into commodity scanning and botnet recruitment against exposed embedded devices. Successful exploitation yields full confidentiality, integrity, and availability impact on the device, and the changed scope suggests the compromise may extend to adjacent components.
As of this writing, CVE-2026-77683 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no KEV entry appears in the supplied CVE data; so there is no confirmed in-the-wild exploitation on record and no federally mandated remediation deadline at this time. Public exploit availability ahead of any KEV listing is a pattern that has preceded confirmed exploitation in other cases; it is better treated as a race than a reprieve.
What's Vulnerable
- Vendor: Comfast
- Product: CF-N1-S
- Affected version: 2.6.0.1
- CPE:
cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
The supplied data identifies only version 2.6.0.1 as affected. No other versions or products are listed in the record.
Patch Status
No patch, fixed version, vendor advisory, or mitigation guidance is present in the supplied CVE data. The NVD record was published 2026-08-21 with a vulnerability status of Received, meaning it has not yet completed NVD analysis. Operators running CF-N1-S 2.6.0.1 should treat the management interface as untrusted and restrict network access to it pending vendor remediation.