A critical command injection vulnerability in the Comfast CF-N1-S allows an authenticated remote attacker to execute arbitrary system commands.

The vulnerability exists in the /cgi-bin/mbox-config endpoint, specifically within the timestr parameter of the ntp_timezone section. An authenticated attacker can inject arbitrary commands, which are then executed by the system with elevated privileges.

Command injection allows for full control over the affected network device. An attacker could use this access to pivot into the internal network, intercept traffic, or disrupt critical connectivity services. The CVSS score of 9.9 underscores the extreme risk to the availability and integrity of the affected network infrastructure.

Immediate Action: Check the vendor website for firmware updates; if no update is available, restrict access to the web interface to trusted management subnets only.

Proactive Monitoring: Monitor device traffic and logs for suspicious requests to /cgi-bin/mbox-config containing unusual characters or shell command syntax.

Compensating Controls: Place the device behind a Web Application Firewall (WAF) or a network firewall that can filter malicious payloads targeting the management interface.

Public Exploit Available: No

This vulnerability is highly critical and requires immediate attention. If a firmware update is not currently available from Comfast, administrators must isolate the device management interface from all untrusted network segments to prevent potential exploitation.