A critical stack-based buffer overflow vulnerability in the Comfast CF-N1-S router allows unauthenticated remote attackers to compromise device integrity and availability.

The vulnerability exists within the get_css_path_from_uri function of the /cgi-bin/mbox-config endpoint, where improper boundary checks allow an unauthenticated attacker to overflow a fixed-size stack buffer via a crafted HTTP request.

The CVSS score of 10.0 reflects the critical nature of this flaw, as it allows for unauthenticated remote code execution. Successful exploitation can lead to a complete compromise of the router, enabling attackers to intercept network traffic, pivot into internal segments, or render the device unusable, causing significant operational downtime and security risk.

Immediate Action: As no vendor patch is currently confirmed, administrators should restrict access to the web management interface to trusted internal IP addresses only and disable remote management features.

Proactive Monitoring: Monitor network traffic and device logs for anomalous HTTP requests directed at the /cgi-bin/mbox-config endpoint, specifically looking for unusually long URI strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block requests containing excessively long paths or malformed parameters targeting the management interface.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the research references.

This vulnerability presents a severe risk to network infrastructure due to its unauthenticated remote execution capability. Given the availability of a public proof-of-concept, users must prioritize isolating affected devices from the public internet immediately and contact the vendor for potential firmware updates or workarounds.