CVE-2026-75094CWE-77CWE-78command-injection

CVE-2026-75094

Critical · published August 18, 2026

CVSS v3.1
9.1
EPSS
3%
Percentile
88.0
In the wild
Unconfirmed
What it is

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.03178 · 88.0th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-18T06:17Z
References (5)
https://github.com/1ChaoRen1/IOT_1 · [email protected]https://vuldb.com/cve/CVE-2026-75094 · [email protected]https://vuldb.com/submit/877482 · [email protected]https://vuldb.com/vuln/391346 · [email protected]https://vuldb.com/vuln/391346/cti · [email protected]
EPSS history
Timeline
  • 18 AUG 01:45Z
    COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
    cvelistv5