← Vulnerability feed

Vulnerability record · CVE-2026-2535 · published 16 February 2026

CVE-2026-2535: Comfast cf-n1 firmware injection vulnerability

Comfast · Cf N1 Firmware

A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

2.1 CVSS 4.0 Low EPSS 14% · top 3.6% CWE-74 · InjectionCWE-77 · Command injection
2.1CVSS 4.0 base score, v2 6.5
14%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jinhao118/cve/blob/main/ComFast%20Router_2.md ExploitThird Party Advisory
https://vuldb.com/?ctiid.346123 Permissions RequiredVDB Entry
https://vuldb.com/?id.346123 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.748784 Third Party AdvisoryVDB Entry

Track CVE-2026-2535 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

2.1CVE-2026-2534Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=S…EPSS 14%2.1CVE-2025-9585Comfast cf-n1 firmware injection vulnerabilityA vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipula…EPSS 5.1%2.1CVE-2025-9586Comfast cf-n1 firmware injection vulnerabilityA vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. S…EPSS 8.3%2.1CVE-2025-9582Comfast cf-n1 firmware injection vulnerabilityA flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argum…EPSS 5.3%2.1CVE-2025-9583Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The m…EPSS 5.1%2.1CVE-2025-9584Comfast cf-n1 firmware injection vulnerabilityA vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manip…EPSS 8.3%2.1CVE-2025-9581Comfast cf-n1 firmware injection vulnerabilityA vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of t…EPSS 5.3%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed

Source: NIST National Vulnerability Database (record CVE-2026-2535), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.