A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the sprintf function within the /cgi-bin/mbox-config CGI endpoint when the method is SET and section is ptest_sn. An attacker can manipulate the 'sn' argument to inject arbitrary commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This affects network/IoT devices running the vulnerable firmware version. The issue has been assigned CVE-2026-77004 and documented on NVD and VulDB. Organizations using Comfast CF-N1-S devices should review exposure and apply mitigations promptly.