CVE-2026-77683

The vulnerability in CVE-2026-77683 is a timezone parameter command injection in the Comfast CF-N1-S access point's /cgi-bin/mbox-config CGI handler. The 'timestr' argument—a timezone identifier—gets interpolated directly into a shell command rather than being validated and written to a configuration file. This is not a buffer overflow; it is configuration data crossing into execution context, a pattern that should never exist in production firmware handling remote input. The 9.9 CVSS score warrants scrutiny: the gap from 10.0 likely reflects the 'adjacent network' scope assumption in CVSS vector calculations. However, this device class occupies network chokepoints by design—access points bridge wireless clients to wired networks in hospitality, retail, and small business environments. The scoring framework was calibrated for traditional server ecosystems where a compromised endpoint is one of many; an access point that IS the network inverts those assumptions entirely. A public exploit against a device at a network boundary achieves scope compromise the scorecard doesn't reflect. What defenders should check: verify whether your Comfast CF-N1-S firmware (version 2.6.0.1 and possibly earlier) has received an update addressing this CGI handler. The more critical question is what other devices share this codebase—this timezone handler likely exists in sibling binaries on the same device and potentially across the manufacturer's product line that shares the SDK. The vulnerability gene pattern has recurred across two decades of embedded firmware (Linksys WRT54G circa 2003, Netgear NAS circa 2008, IoT cameras circa 2015), almost always through inherited SDK code rather than independent reinvention. The ODM supply chain inherited this vulnerability vertically. The temporal gap matters more than the scoring: devices in the deployment environments where this AP operates—hospitality and retail networks—rarely receive firmware updates. A patch may exist while the installed base remains exploitable for years. Assume active exploitation is already occurring against unpatched populations.

Reviewed through automated stages and approved by a human before publication.