CVE-2026-2534 is a critical command injection vulnerability affecting Comfast CF-N1 V2 2.6.0.2 firmware. An authenticated attacker can remotely execute arbitrary commands by manipulating the "bandwidth" argument within the /cgi-bin/mbox-config?method=SET§ion=ptest_bandwidth function. This vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk with high impact on confidentiality, integrity, and availability, and can be exploited with low attack complexity. While public exploit details exist, there is no evidence of active exploitation, and community discussion or media coverage is currently minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.6.0.2CPE matchmatch criteria | cpe:2.3:o:comfast:cf-n1_firmware:2.6.0.2:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026Comfast CF-N1 Command Injection (CVE-2026-2534)
Mar 17, 2026