CVE-2026-77683CWE-74CWE-77command-injection

CVE-2026-77683

Critical · published August 21, 2026

CVSS v3.1
9.9
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.02889 · 86.8th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-08-21T15:17Z
References (5)
https://github.com/AdminSafe/CVE/issues/8 · [email protected]https://vuldb.com/cve/CVE-2026-77683 · [email protected]https://vuldb.com/submit/881058 · [email protected]https://vuldb.com/vuln/394033 · [email protected]https://vuldb.com/vuln/394033/cti · [email protected]
EPSS history
Timeline
  • 21 AUG 10:15Z
    Comfast CF-N1-S mbox-config system command injection
    cvelistv5