Loading story…
A critical stack-based buffer overflow, tracked as CVE-2026-94003 with a CVSS v3 score of 10.0, affects Comfast CF-N1-S wireless routers running firmware 2.6.0.1. The flaw resides in the get_css_path_from_uri function and is reachable through the Web Management Interface endpoint /cgi-bin/mbox-config, potentially allowing remote unauthenticated exploitation without user interaction. A public proof of concept is available.
No confirmed exploitation in the wild, fixed firmware release, or vendor-confirmed mitigation has been reported. Organizations should immediately restrict access to router management interfaces, disable remote administration where feasible, monitor for anomalous requests to /cgi-bin/mbox-config, and prepare to replace affected devices if Comfast does not issue remediation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A disclosure reported a critical stack-based buffer overflow (CVE-2026-94003) affecting Comfast CF-N1-S routers running firmware 2.6.0.1. The flaw is reachable through the Web Management Interface endpoint /cgi-bin/mbox-config, and a public proof-of-concept was reported as available.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Belkin router models, **F9K1122** firmware `1.00.33` and **F9K1015** firmware `1.00.10`, were disclosed with remotely exploitable stack-based buffer overflow vulnerabilities in the `formWISP5G` function exposed through the `/goform/formWISP5G` endpoint. In both cases, an attacker can manipulate the `webpage` argument to trigger memory corruption, creating a path to compromise confidentiality, integrity, and availability on affected devices. The flaws were assigned **CVE-2026-4566** and **CVE-2026-5610**, and both are mapped to **CWE-119** and **CWE-121**. Public exploit availability was noted for each issue, increasing the immediate risk to internet-exposed or unpatched routers. The disclosures also state that the vendor was contacted before publication but did not respond, leaving defenders to identify affected Belkin devices and prioritize mitigation or replacement.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 `1.0.0.9`** and **FH1201 `1.2.0.14(408)`**. The flaws, tracked as **`CVE-2026-4535`** and **`CVE-2026-5045`**, are stack-based buffer overflows in the `WrlclientSet` function exposed through the `/goform/WrlclientSet` endpoint. In both cases, an attacker can trigger the issue by manipulating the `GO` argument, creating a remotely reachable attack path against the devices' web management interface. Both CVEs are classified under **`CWE-119`** and **`CWE-121`**, and published scoring indicates high impact to **confidentiality, integrity, and availability**, with some vectors rating the flaws at critical severity. Public exploit information is already available for both issues, raising the risk of real-world exploitation against unpatched internet-exposed routers and embedded deployments using the affected firmware.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 1.0.0.9** and **F453 1.0.0.3**. The flaws are tracked as `CVE-2026-4534` and `CVE-2026-4552` and both involve remotely reachable stack-based buffer overflows in web management handlers. In the FH451 case, the issue is in the `formWrlExtraSet` function exposed through the `/goform/WrlExtraSet` component, where manipulation of the `GO` argument can trigger memory corruption. In the F453 case, the vulnerable code is the `fromVirtualSer` function behind the `/goform/VirtualSer` endpoint, where the `page` argument can be abused to cause a similar overflow. Both CVE records indicate that **public exploits are available**, increasing the likelihood of opportunistic attacks against exposed devices. The disclosures map the weaknesses to `CWE-119` and `CWE-121`, reflecting out-of-bounds memory handling and stack-based buffer overflow conditions, and the published scoring points to high impact on confidentiality, integrity, and availability. Organizations using these Tenda models should treat the flaws as urgent remote compromise risks, especially where router administration interfaces are internet-accessible.
Jun 29, 2026