Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-94003: Comfast CF-N1-S web interface can be remotely crashed
CVE-2026-94003 · published 29 days ago
Summary
The web management page of the Comfast CF-N1-S router (version 2.6.0.1) contains a coding error that lets a remote user send specially crafted data and overflow the program’s memory. This can cause the router to stop responding or be taken over by an attacker. Apply the latest firmware update from the vendor and limit external access to the management interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| comfast | cf-n1-s | 2.6.0.1 |
Original advisory text
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published20 Sep 2026
Updated19 Oct 2026
First seen20 Sep 2026
Track software like this
Free during beta