Vulnerability · Published Mar 20, 2026 · Assigned by VulDB

CVE-2026-4468Comfast CF-AC100 mbox-config command injection

Medium 4.7

In plain English

A medium-severity command injection in CF-AC100 from Comfast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)3.6%top 10.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET&section=update_interface_png. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Comfast	CF-AC100	2.6.0.8

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-351758 | Comfast CF-AC100 mbox-config command injection vdb-entry
VDB-351758 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #772878 | Comfast CF-AC100 V2.6.0.8 Command Injection third-party-advisory
https://github.com/jinhao118/cve/blob/main/ComFast%20CF-AC100-V2.6.0.8_4.md exploit