CVE-2026-3798
Published: 09 March 2026
Summary
CVE-2026-3798 is a medium-severity Injection (CWE-74) vulnerability in Comfast Cf-Ac100 Firmware. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3798 is a command injection vulnerability in the Comfast CF-AC100 router firmware version 2.6.0.8. It affects the sub_44AC14 function in the file /cgi-bin/mbox-config?method=SET§ion=ping_config within the Request Path Handler component. Published on 2026-03-09, the issue is classified under CWE-74 and CWE-77.
A remote attacker with high privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables command injection, resulting in limited impacts to confidentiality, integrity, and availability, as reflected in its CVSS 3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Advisories from VulDB and a public GitHub repository detail the vulnerability and provide an exploit, but the vendor was contacted early without any response, indicating no patches or official mitigations are available. Security practitioners should isolate affected devices and monitor for anomalous activity in the ping_config endpoint.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10290
Vulnerability details
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public…
more
and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router web endpoint (/cgi-bin/mbox-config ping_config handler) directly enables T1190 for initial access and T1059.008 for Network Device CLI execution on firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input to the ping_config parameter, blocking the command injection payload before execution.
Limits the high-privilege accounts that can reach the /cgi-bin/mbox-config SET handler, reducing the population able to trigger the injection.
Enables monitoring of the ping_config endpoint for anomalous command strings or unexpected process execution on the device.