Comfast CF-N1-S V2 Router Web Stack Buffer Overflow Analysis

Vulnerability Overview Vulnerability Title: Comfast CF-N1-S V2 V2.6.0.1 Buffer Overflow Vulnerability Description: A stack-based buffer overflow vulnerability exists in the web management component of the COMFAST CF-N1-S V2 router. The vulnerability occurs in the function while processing the HTTP request . The relevant logic is triggered when and . An attacker can send a carefully crafted HTTP POST request with a valid session cookie to enter the SSID configuration processing flow. Exploitation Method: In the exploitation chain, the user-controlled parameter (corresponding to the global configuration item ) is passed to the function for formatting and finally written to a fixed-size buffer on the stack. Since this write operation resembles unsafe formatting behavior (such as ) and there are no length restrictions or boundary checks on the input, a stack buffer overflow occurs when the parameter length exceeds the buffer capacity. Consequences: After the overflow, the attacker can overwrite adjacent local variables and the function return address, destroying the stack frame structure of the current function, ultimately leading to a program crash. Under specific conditions, this may also lead to controllable control flow hijacking risks. Affected Scope Affected Devices: COMFAST CF-N1-S V2 Router Affected Versions: V2.6.0.1 Remediation Remediation Status: Fixed Remediation Date: July 5, 2025 POC Code/Exploit Code No specific POC code or exploit code was provided in the page. Other Information Source: GitHub Link Submitter: 010hex (UID 99386) Submission Date: May 2, 2025 Review Date: May 20, 2025 VulDB Entry: VulDB Link Points: 20

Goal Reached Thanks to every supporter — we hit 100%!

Comfast CF-N1-S V2 Router Web Stack Buffer Overflow Analysis