CVE-2026-76008

Comfast CF-N1-S 2.6.0.1 has a stack-based buffer overflow in the get_para_from_uri function of /cgi-bin/mbox-config, triggered by manipulating the width/height URI parameters. CVSS 10.0 (Critical) allows unauthenticated remote attackers to achieve full system compromise. No patch or exploit detai...

CVE-2026-76008 Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

PT-2026-78262

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get para from uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

CVE-2026-75094

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

CVE-2026-75094 COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

CVE-2026-75094

COMFAST CF-N1-S firmware 2.6.0.1 has an OS command injection flaw in the CGI endpoint /cgi-bin/mbox-config?method=SET&section=ptest_ssid (function sub_44B438): the ssid parameter is passed unsanitized to a shell, enabling remote attackers with high privileges to execute arbitrary OS commands. CVS...

CVE-2026-75094

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

EUVD-2026-60566

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

CVE-2026-19976

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...

CVE-2026-19976 COMFAST CF-N1-S mbox-config sub_44A968 command injection

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...

CVE-2026-19976

CVE-2026-19976 affects COMFAST CF-N1-S firmware 2.6.0.1. The vulnerability exists in the function sub_44A968 within /cgi-bin/mbox-config?method=SET&section=ptest_macaddress, where improper handling of the macaddress argument enables remote command injection. The issue can be exploited remotely; p...

CVE-2026-19976

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...

EUVD-2026-60036

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptestmacaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit...

OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media

These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8. A patched version of the package is available...

UBUNTU-CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

EUVD-2026-48923

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

AZL-93144 CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-58488 HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used th...

EUVD-2026-43252

A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function systemwluploadpicfile of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to...