CVE-2026-2823 is a critical command injection vulnerability affecting Comfast CF-E7 firmware version 2.6.0.9. An authenticated attacker can remotely execute arbitrary commands by manipulating the 'timestr' argument within the '/cgi-bin/mbox-config?method=SET§ion=ntp_timezone' function. This vulnerability carries a CVSS score of 8.8 (High), indicating a high potential for impact on confidentiality, integrity, and availability. While public exploit code is available, there is currently no evidence of active exploitation, and it has garnered minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.6.0.9CPE matchmatch criteria | cpe:2.3:o:comfast:cf-e7_firmware:2.6.0.9:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Comfast CF-E7 Command Injection (CVE-2026-2823)
Mar 17, 2026Comfast CF-E7 Command Injection (CVE-2026-2823)
Mar 17, 2026Comfast CF-E7 Command Injection (CVE-2026-2823)
Mar 17, 2026Comfast CF-E7 Command Injection (CVE-2026-2823)
Mar 17, 2026Comfast CF-E7 Command Injection (CVE-2026-2823)
Mar 17, 2026