# cve.now: Comfast

The newest entries naming Comfast as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-122013](https://cve.now/CVE-2026-122013.md): Comfast CF-WR632AX Multipart webmgnt path traversal (CVSS 10.0)
- [CVE-2026-94003](https://cve.now/CVE-2026-94003.md): Comfast CF-N1-S Web Management mbox-config get\_css\_path\_from\_uri stack-based overflow (CVSS 10.0)
- [CVE-2026-78050](https://cve.now/CVE-2026-78050.md): Comfast CF-N1-S Web Management mbox-config sub\_41AD7C stack-based overflow (CVSS 9.4)
- [CVE-2026-77683](https://cve.now/CVE-2026-77683.md): Comfast CF-N1-S mbox-config system command injection (CVSS 9.4)
- [CVE-2026-77148](https://cve.now/CVE-2026-77148.md): Comfast CF-N1-S Web Management mbox-config sub\_44B50C stack-based overflow (CVSS 9.4)
- [CVE-2026-77022](https://cve.now/CVE-2026-77022.md): Comfast CF-N1-S SSID Configuration mbox-config sub\_44B438 stack-based overflow (CVSS 9.4)
- [CVE-2026-77004](https://cve.now/CVE-2026-77004.md): Comfast CF-N1-S mbox-config sprintf command injection (CVSS 5.3)
- [CVE-2026-76008](https://cve.now/CVE-2026-76008.md): Comfast CF-N1-S URI Parameter Parsing mbox-config get\_para\_from\_uri stack-based overflow (CVSS 10.0)
- [CVE-2026-75094](https://cve.now/CVE-2026-75094.md): COMFAST CF-N1-S CGI mbox-config sub\_44B438 os command injection (CVSS 9.4)
- [CVE-2026-19976](https://cve.now/CVE-2026-19976.md): COMFAST CF-N1-S mbox-config sub\_44A968 command injection (CVSS 5.1)
- [CVE-2026-15511](https://cve.now/CVE-2026-15511.md): Comfast CF-WR631AX V3 FastCGI Backend webmgnt system\_wl\_upload\_pic\_file os command injection (CVSS 9.3)
- [CVE-2026-12814](https://cve.now/CVE-2026-12814.md): Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection (CVSS 5.3)
- [CVE-2026-6799](https://cve.now/CVE-2026-6799.md): Comfast CF-N1-S Endpoint mbox-config command injection (CVSS 5.3)
- [CVE-2026-4468](https://cve.now/CVE-2026-4468.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1)
- [CVE-2026-4467](https://cve.now/CVE-2026-4467.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1)
- [CVE-2026-4466](https://cve.now/CVE-2026-4466.md): Comfast CF-AC100 mbox-config command injection (CVSS 5.1)
- [CVE-2026-3798](https://cve.now/CVE-2026-3798.md): Comfast CF-AC100 Request Path mbox-config sub\_44AC14 command injection (CVSS 5.1)
- [CVE-2026-2824](https://cve.now/CVE-2026-2824.md): Comfast CF-E7 webmggnt mbox-config sub\_441CF4 command injection (CVSS 5.3)
- [CVE-2026-2823](https://cve.now/CVE-2026-2823.md): Comfast CF-E7 webmggnt mbox-config sub\_41ACCC command injection (CVSS 5.3)
- [CVE-2026-2537](https://cve.now/CVE-2026-2537.md): Comfast CF-E4 HTTP POST Request mbox-config command injection (CVSS 5.1)
- [CVE-2026-2535](https://cve.now/CVE-2026-2535.md): Comfast CF-N1 V2 mbox-config sub\_44AB9C command injection (CVSS 5.3)
- [CVE-2026-2534](https://cve.now/CVE-2026-2534.md): Comfast CF-N1 V2 mbox-config sub\_44AC4C command injection (CVSS 5.3)
- [CVE-2025-9586](https://cve.now/CVE-2025-9586.md): Comfast CF-N1 webmgnt wireless\_device\_dissoc command injection (CVSS 5.3)
- [CVE-2025-9585](https://cve.now/CVE-2025-9585.md): Comfast CF-N1 webmgnt wifilith\_delete\_pic\_file command injection (CVSS 5.3)
- [CVE-2025-9584](https://cve.now/CVE-2025-9584.md): Comfast CF-N1 webmgnt update\_interface\_png command injection (CVSS 5.3)
- [CVE-2025-9583](https://cve.now/CVE-2025-9583.md): Comfast CF-N1 webmgnt ping\_config command injection (CVSS 5.3)
- [CVE-2025-9582](https://cve.now/CVE-2025-9582.md): Comfast CF-N1 webmgnt ntp\_timezone command injection (CVSS 5.3)
- [CVE-2025-9581](https://cve.now/CVE-2025-9581.md): Comfast CF-N1 webmgnt multi\_pppoe command injection (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/comfast
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.