CVE-2026-3798
Published: 09 March 2026
Summary
CVE-2026-3798 is a medium-severity Injection (CWE-74) vulnerability in Comfast Cf-Ac100 Firmware. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router web endpoint (/cgi-bin/mbox-config ping_config handler) directly enables T1190 for initial access and T1059.008 for Network Device CLI execution on firmware.
NVD Description
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public…
more
and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-3798 is a command injection vulnerability in the Comfast CF-AC100 router firmware version 2.6.0.8. It affects the sub_44AC14 function in the file /cgi-bin/mbox-config?method=SET§ion=ping_config within the Request Path Handler component. Published on 2026-03-09, the issue is classified under CWE-74 and CWE-77.
A remote attacker with high privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables command injection, resulting in limited impacts to confidentiality, integrity, and availability, as reflected in its CVSS 3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Advisories from VulDB and a public GitHub repository detail the vulnerability and provide an exploit, but the vendor was contacted early without any response, indicating no patches or official mitigations are available. Security practitioners should isolate affected devices and monitor for anomalous activity in the ping_config endpoint.
Details
- CWE(s)