Comfast CF-N1-S Command Injection Vulnerability in Endpoint Component

A command injection vulnerability has been identified in the Comfast CF-N1-S router, specifically in the V2.6.0.1 firmware. The issue arises in the Endpoint component, within the file '/cgi-bin/mbox-config?method=SET&section=ping_config'. The vulnerability allows authenticated attackers to inject arbitrary commands through the 'destination' parameter, which are then executed on the device with the privileges of the web service. This exploitation could lead to a full compromise of the device.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary commands on the device, potentially leading to a complete compromise.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to '/cgi-bin/mbox-config?method=SET&section=ping_config'. The request must include a crafted 'destination' parameter that contains the command to be executed. This can be done using a session cookie to maintain authentication.