cbcvebase.
CVE-2026-2537
published 2026-02-16

CVE-2026-2537: A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the…

PriorityP268high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
18.25%
96.9th percentile
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges
VendorProductVersion rangeFixed in
comfastcf-e4——
comfastcf-e4_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/mbox-config↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS ComFast mbox-config ntp_timezone timestr Parameter Command Injection Attempt (CVE-2026-2823, CVE-2026-2537)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/mbox-config|3f|"; fast_pattern; startswith; content:"method|3d|SET"; content:"section|3d|ntp_timezone"; http.request_body; content:"|22|timestr|22|"; pcre:"/^(?:\x3a(?:\x20\x22|\x22))?[^\x2c\x7d$]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/jinhao118/cve/blob/main/ComFast%20CF-AC100-V2.6.0.8_2.md; reference:cve,2026-2823; reference:cve,2026-2537; classtype:attempted-admin; sid:2068153; rev:1;)
  • →Target HTTP POST requests to the URI path /cgi-bin/mbox-config with query parameters method=SET and section=ntp_timezone; the injection payload is delivered in the request body within the 'timestr' JSON field.
  • →Detect command injection metacharacters in the timestr parameter value: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24) — both raw and URL-encoded forms should be inspected.
  • →The attack is remotely exploitable over plaintext HTTP (not TLS); deploy detection at both perimeter and internal network boundaries.
  • →The exploit is publicly available; treat any matching traffic as high-severity attempted administrative access (classtype:attempted-admin) mapped to MITRE T1190 (Exploit Public-Facing Application).
  • ·The vulnerable endpoint requires the HTTP POST body to contain the 'timestr' parameter as a JSON key (|22|timestr|22|); ensure deep packet inspection / HTTP body inspection is enabled on the monitoring sensor for this rule to fire.
  • ·The Snort/Suricata rule (sid:2068153) uses a PCRE with the /R (relative) flag anchored after the timestr key match; verify your IDS engine supports relative PCRE anchoring to avoid false negatives.
  • ·This rule covers two related CVEs (CVE-2026-2823 and CVE-2026-2537) simultaneously; confirm which specific Comfast device model and firmware version is in scope before tuning alert thresholds.

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.8MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.