CVE-2026-2537

Comfast CF-E4 firmware 2.6.0.1 contains a command injection flaw (CWE-74/CWE-77) in the HTTP POST request handler of the /cgi-bin/mbox-config endpoint (method=SET, section=ntp_timezone). An attacker who can reach this endpoint sends a crafted value in the 'timestr' parameter, which is passed unsanitized into a shell command when the device's NTP timezone setting is saved, allowing arbitrary commands to run on the device. A public proof-of-concept demonstrating remote code execution exists, though the CVSS 4.0 base score of 2 (low) indicates the attack requires elevated privileges, likely an authenticated administrator session, and has limited scoped impact. Only deployments running CF-E4 firmware 2.6.0.1 (other versions unconfirmed, as the vendor did not respond to the disclosure) are known to be affected, and the attack is launched remotely over the network. Exploitation has not been confirmed in the wild, but the public exploit plus a 24.5% EPSS score (98th percentile) means opportunistic attacks are plausible in the next 30 days; the issue is not yet in CISA's KEV catalog.

What to do: No vendor patch is currently available since Comfast did not respond to the disclosure, so check firmware version 2.6.0.1 on CF-E4 devices and apply fixed firmware when the vendor publishes it. Until then, do not expose the device's web management interface to the internet (restrict to a trusted management VLAN or firewall rules), ensure administrator credentials are strong, and monitor for unexpected processes or configuration changes. As a temporary mitigation, consider blocking untrusted access to the /cgi-bin/mbox-config endpoint.