A critical stack-based buffer overflow in Comfast CF-N1-S firmware permits remote code execution, posing a severe risk to device integrity.

This is a stack-based buffer overflow occurring in the sub_41AD7C function of the web management interface, triggered by improper input validation of the timestr or ntp_client_enabled arguments. The attack requires low privileges (authenticated) to execute.

The exploitation of this vulnerability allows for remote code execution, potentially granting an attacker full control over the affected hardware. Given the CVSS score of 9.9, this represents a critical risk that could lead to complete system compromise, data exfiltration, or the use of the device as a pivot point within the network.

Immediate Action: Contact the vendor for firmware updates, as no specific patch version is currently identified. If an update is unavailable, restrict access to the web management interface to trusted IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the device and review system access logs for unauthorized attempts to access the /cgi-bin/mbox-config endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing abnormally long strings in the timestr or ntp_client_enabled parameters.

Public Exploit Available: No (exploit_available: unknown)

Due to the critical severity of this vulnerability, immediate mitigation is required. Administrators should isolate the affected device from the public internet and apply vendor-supplied updates as soon as they become available.