PT-2026-21000 · Comfast · Comfast Cf-E7

Allanp0E

·

Published

2026-02-20

·

Updated

2026-02-20

·

CVE-2026-2824

CVSS v3.1
8.8
VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Comfast CF-E7 version 2.6.0.9
Description A flaw exists in Comfast CF-E7 version 2.6.0.9 that allows for remote command injection. The issue is located within the 
webmggnt
component, specifically in the 
sub 441CF4
function of the 
/cgi-bin/mbox-config?method=SET&section=ping config
file. Manipulation of the 
destination
argument can trigger the command injection. An exploit for this issue has been published.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74CWE-77

Related Identifiers

CVE-2026-2824

Affected Products

Comfast Cf-E7