CVE-2026-6799

CVE-2026-6799 is a command injection vulnerability discovered in Comfast CF-N1-S version 2.6.0.1, specifically within the ping_config endpoint of the /cgi-bin/mbox-config component. An authenticated attacker can manipulate the destination parameter to execute arbitrary commands on affected devices. The vulnerability carries a CVSS v3.1 score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and valid credentials but no user interaction. The impact is moderate, affecting confidentiality, integrity, and availability of the targeted system. The exploit code has been publicly released and the vulnerability appears on the active Hot List, indicating current exploitation activity. However, the EPSS score of 0.0084 suggests relatively low real-world exploitation prevalence compared to other CVEs. Notably, the vendor has not responded to early disclosure notifications, leaving no official patch available for affected users.