SECURITYCRITICALCVE-2026-94003

CVE-2026-94003: Perfect-10 Stack Buffer Overflow in Comfast CF-N1-S Routers

Comfast CF-N1-S 2.6.0.1's mbox-config CGI handler allows unauthenticated, network-based stack buffer overflow scoring a maximum CVSS 10.0.

Dylan H.

Security Team

September 21, 2026
3 min read
CVE-2026-94003: Perfect-10 Stack Buffer Overflow in Comfast CF-N1-S Routers

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Comfast CF-N1-S v2.6.0.1

Overview

A critical stack-based buffer overflow has been disclosed in the Comfast CF-N1-S wireless router, tracked as CVE-2026-94003. The flaw sits in the get_css_path_from_uri function of /cgi-bin/mbox-config, part of the device's Web Management Interface, and can be triggered remotely by an unauthenticated attacker. NVD scores the vulnerability a maximum CVSS 3.1 base score of 10.0 — the ceiling of the scale.

Technical Details

FieldValue
CVE IDCVE-2026-94003
SeverityCritical (CVSS 3.1: 10.0)
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
WeaknessCWE-119 (Improper Restriction of Operations within Memory Buffer), CWE-121 (Stack-based Buffer Overflow)
Vulnerable Functionget_css_path_from_uri
Vulnerable File/cgi-bin/mbox-config
ComponentWeb Management Interface
AuthenticationNone required
Exploit MaturityPublic PoC available

How It Works

The mbox-config CGI endpoint passes an attacker-controlled URI into get_css_path_from_uri without bounds-checking the resulting buffer copy. Because the vulnerability's Scope is Changed (S:C) in the CVSS vector, a successful overflow can impact resources beyond the vulnerable component itself — consistent with full device compromise rather than a contained crash. Combined with a network attack vector, low attack complexity, and zero authentication or user interaction requirements, that scope change is what pushes the score to a perfect 10.0.

A working proof-of-concept has already been published (see references), meaning mass scanning and automated exploitation attempts should be expected shortly after disclosure.

Impact Assessment

Who Is At Risk

  • Any deployment running Comfast CF-N1-S firmware v2.6.0.1 with the web management interface reachable — either over LAN or, worse, exposed to the internet via port-forwarding or a misconfigured WAN admin panel
  • Comfast devices are commonly deployed in budget SOHO and hospitality/guest-network setups, environments that are frequently under-monitored

Potential Impact

  • Full device takeover via memory corruption leading to arbitrary code execution
  • Network pivot point — a compromised router sits between the internet and every device on the LAN, enabling traffic interception, DNS hijacking, and lateral movement
  • Botnet recruitment — unauthenticated, network-reachable router RCE bugs are a favorite building block for IoT botnets (Mirai-style) used in DDoS campaigns

Mitigation

  • Disable remote/WAN access to the web management interface immediately; restrict administration to trusted LAN segments only
  • Check for a firmware update from Comfast. No vendor advisory was available at time of writing — budget router vendors historically lag on CVE response, so treat network-level mitigation as the primary control, not a stopgap
  • Segment IoT/router management traffic from general user networks via VLAN where possible
  • Monitor for anomalous CGI requests to mbox-config in any available device or upstream firewall logs
  • If a patch does not materialize, evaluate replacing affected units — an unauthenticated CVSS 10.0 RCE with public exploit code on unmaintained hardware is not a risk worth carrying long-term

References