A critical buffer overflow vulnerability in the Comfast CF-N1-S router allows unauthenticated remote attackers to achieve full system compromise via malformed URI parameters.

The vulnerability resides in the get_para_from_uri function within the mbox-config component, where improper handling of width or height arguments causes a stack-based buffer overflow (CWE-121).

This vulnerability carries a maximum CVSS score of 10.0, indicating the highest level of risk. An attacker can remotely execute code on the device without authentication, leading to complete control over the router and potentially the ability to intercept or redirect traffic for all connected clients.

Immediate Action: Disable remote management of the device immediately and restrict access to the web interface to internal, trusted networks.

Proactive Monitoring: Inspect network traffic for unusually long URI strings or malformed HTTP requests directed at the /cgi-bin/mbox-config path.

Compensating Controls: Use a firewall to block all traffic to the device's administrative interface from untrusted or public networks.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Given the lack of authentication requirements and the existence of a public proof-of-concept, this device is at extreme risk. If a firmware update is not available from the vendor, the device should be replaced or permanently isolated from all public-facing network segments.