CVE-2026-3798 - Vulnerability Analysis

Overview

Comfast CF-AC100 2.6.0.8 contains a command injection caused by manipulation of the request path handler in /cgi-bin/mbox-config?method=SET&section=ping_config, letting remote attackers execute arbitrary commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary commands, potentially taking full control of the device.

Mitigation

Update to the latest version or apply vendor patches if available.

References

• https://vuldb.com/?ctiid.349765
• https://vuldb.com/?id.349765
• https://vuldb.com/?submit.766443
• https://github.com/jinhao118/cve/blob/main/ComFast%20CF-AC100-V2.6.0.8_1.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner