CVE-2026-75094 COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

Critical 9.4 Published 18 Aug 2026 Updated 18 Aug 2026

Remote attackers can execute arbitrary OS commands via the ssid parameter in the mbox-config CGI interface of COMFAST CF-N1-S devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-75094?

CVE-2026-75094 is a critical command injection vulnerability in COMFAST CF-N1-S, published on 18 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Weakness: CWE-78, CWE-77

Which versions are affected by CVE-2026-75094?

How do I fix CVE-2026-75094?

No fix has been published for CVE-2026-75094 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-75094 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75094 exists.

Sources

Also known as GHSA-qp57-ch36-236j.