CVE-2026-2823

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Comfast	CF-E7	2.6.0.9

References

https://github.com/jinhao118/cve/blob/main/ComFast%20Router_3.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.346948Permissions Required, VDB Entry
https://vuldb.com/?id.346948Third Party Advisory, VDB Entry
https://vuldb.com/?submit.753871Third Party Advisory, VDB Entry

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-282306.3SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransactio CVE-2026-282319.1pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encod CVE-2026-282375.5Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of ava CVE-2026-28248.8A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=pin CVE-2026-282475.9Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firmware could allow a ma CVE-2026-282485.9Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to pote CVE-2026-282494.6Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualization (SEV) firmwa CVE-2026-28253.5A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the c CVE-2026-282529.8A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacke CVE-2026-282537.5A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthentica CVE-2026-282547.5A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access CVE-2026-282559.8A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensi