Vulnerability · Published Aug 20, 2026 · Assigned by VulDB
CVE-2026-77148Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow
Critical 9.9
In plain English
A critical-severity stack buffer overflow in CF-N1-S from Comfast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-393733 | Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow vdb-entry, technical-description
- VDB-393733 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-77148 | CVE Analysis and Report third-party-advisory
- Submit #880910 | Comfast CF-N1-S V2.6.0.1 Buffer Overflow third-party-advisory
- https://github.com/AdminSafe/CVE/issues/7 exploit, issue-tracking