Description
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RAV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:URExploitation Context
as of October 15, 2026- Its current EPSS score (28.0%) is higher than that of 40% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Comfast | Comfast CF-E4 | 2.6.0.1 |
References
4 LinksRecord Details
More from Comfast
Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
Comfast CF-N1 V2 mbox-config sub_44AC4C command injection
Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.