SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-78050 2026-08-22

Comfast CF-N1-S Hit by Critical Stack Overflow in Web Management NTP Handler

"A publicly disclosed stack-based buffer overflow in the Comfast CF-N1-S router's web management interface (CVE-2026-78050) lets a remotely authenticated attacker corrupt memory with a full compromise impact rating of…"

A publicly disclosed stack-based buffer overflow in the Comfast CF-N1-S router's web management interface (CVE-2026-78050) lets a remotely authenticated attacker corrupt memory with a full compromise impact rating of CVSS 9.9.

What Is It

CVE-2026-78050 is a stack-based buffer overflow (CWE-121 / CWE-119) in Comfast CF-N1-S firmware version 2.6.0.1. The flaw sits in the function sub_41AD7C, reached through the Web Management component at /cgi-bin/mbox-config?method=SET&section=ntp_timezone. Manipulating the timestr and ntp_client_enabled arguments triggers the overflow. The attack can be launched remotely over the network, and the exploit has been made public.

Why It Matters

The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, no user interaction, and only low privileges required. (The supplied record prints this vector with a CVSS:4.0/ prefix, but the metrics themselves, notably S:C, exist only in CVSS 3.1, so the prefix is malformed and the vector is read here as 3.1.) The scope is marked Changed, with High impact to confidentiality, integrity, and availability, meaning successful exploitation reaches beyond the vulnerable component itself. The CVSS 4.0 secondary metric scores 8.6 (HIGH) and rates exploit maturity as PROOF_OF_CONCEPT.

A public exploit against a web management endpoint on a consumer-grade router is a low-effort target for any attacker who can reach that interface. The supplied data does not indicate whether affected devices typically expose web management to the internet, so the realistic attack surface depends on each deployment's network position; LAN-only exposure narrows it considerably, WAN-side exposure does not.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data, so there is no confirmed active exploitation at this time; only a public proof of concept.

What's Vulnerable

Patch Status

No vendor patch, fixed version, or remediation guidance is present in the supplied source material. The CVE record currently carries a vulnerability status of "Received," meaning NVD analysis is not yet complete and the entry's details may still change. Because no fix is documented, the practical mitigation is to restrict network access to the device's web management interface, particularly from untrusted networks, until vendor guidance appears.

Sources