Comfast CF-N1 V2 Command Injection Vulnerability

A command injection vulnerability exists in the Comfast CF-N1 V2 router, specifically in version 2.6.0.2. The issue arises in the 'sub_44AC4C' function within the '/cgi-bin/mbox-config?method=SET&section=ptest_bandwidth' endpoint. This vulnerability allows remote attackers to execute arbitrary commands by manipulating the 'bandwidth' parameter. Exploitation requires authentication to obtain a session cookie.

Impact

Successful exploitation allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/mbox-config?method=SET&section=ptest_bandwidth' with a 'bandwidth' value that includes a command injection payload. The request must include a valid session cookie to authenticate the user.