CVE-2026-94003

Summary

The flaw is a stack-based buffer overflow in the get_css_path_from_uri function of the Comfast CF-N1-S 2.6.0.1 Web Management Interface, which can lead to remote code execution if exploited.

Exploitability

Exploitation is relatively easy given the remote access requirement and the critical severity, but requires the attacker to manipulate the URI to trigger the overflow.

Blast radius

If exploited, the vulnerability could allow an attacker to execute arbitrary code on the device, potentially leading to full control of the affected Comfast CF-N1-S device.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Comfast CF-N1-S 2.7.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.