Overview
A critical stack-based buffer overflow has been disclosed in the Comfast CF-N1-S wireless router, tracked as CVE-2026-94003. The flaw sits in the get_css_path_from_uri function of /cgi-bin/mbox-config, part of the device's Web Management Interface, and can be triggered remotely by an unauthenticated attacker. NVD scores the vulnerability a maximum CVSS 3.1 base score of 10.0 — the ceiling of the scale.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-94003 |
| Severity | Critical (CVSS 3.1: 10.0) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Weakness | CWE-119 (Improper Restriction of Operations within Memory Buffer), CWE-121 (Stack-based Buffer Overflow) |
| Vulnerable Function | get_css_path_from_uri |
| Vulnerable File | /cgi-bin/mbox-config |
| Component | Web Management Interface |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
How It Works
The mbox-config CGI endpoint passes an attacker-controlled URI into get_css_path_from_uri without bounds-checking the resulting buffer copy. Because the vulnerability's Scope is Changed (S:C) in the CVSS vector, a successful overflow can impact resources beyond the vulnerable component itself — consistent with full device compromise rather than a contained crash. Combined with a network attack vector, low attack complexity, and zero authentication or user interaction requirements, that scope change is what pushes the score to a perfect 10.0.
A working proof-of-concept has already been published (see references), meaning mass scanning and automated exploitation attempts should be expected shortly after disclosure.
Impact Assessment
Who Is At Risk
- Any deployment running Comfast CF-N1-S firmware v2.6.0.1 with the web management interface reachable — either over LAN or, worse, exposed to the internet via port-forwarding or a misconfigured WAN admin panel
- Comfast devices are commonly deployed in budget SOHO and hospitality/guest-network setups, environments that are frequently under-monitored
Potential Impact
- Full device takeover via memory corruption leading to arbitrary code execution
- Network pivot point — a compromised router sits between the internet and every device on the LAN, enabling traffic interception, DNS hijacking, and lateral movement
- Botnet recruitment — unauthenticated, network-reachable router RCE bugs are a favorite building block for IoT botnets (Mirai-style) used in DDoS campaigns
Mitigation
- Disable remote/WAN access to the web management interface immediately; restrict administration to trusted LAN segments only
- Check for a firmware update from Comfast. No vendor advisory was available at time of writing — budget router vendors historically lag on CVE response, so treat network-level mitigation as the primary control, not a stopgap
- Segment IoT/router management traffic from general user networks via VLAN where possible
- Monitor for anomalous CGI requests to
mbox-configin any available device or upstream firewall logs - If a patch does not materialize, evaluate replacing affected units — an unauthenticated CVSS 10.0 RCE with public exploit code on unmaintained hardware is not a risk worth carrying long-term