A maximum-severity router bug has a CVSS 10 score - but check who actually owns one
CVE-2026-94003 hits Comfast's CF-N1-S router with the highest possible severity rating, yet key questions about patching and real-world risk are still unanswered.
A newly published vulnerability affecting a Comfast home and small-business router has landed with a CVSS score of 10 - the maximum possible - which sounds like the stuff of nightmares. It probably is, if you happen to own the specific device in question. For most people reading this, it almost certainly isn’t. Here’s what’s actually going on.
What the bug actually does
CVE-2026-94003 affects the CF-N1-S router running firmware version 2.6.0.1, made by Chinese networking vendor Comfast. According to the technical writeup on GitHub, the flaw sits in a function called get_css_path_from_uri, part of the router’s web management interface.
The problem is a classic one: that function copies part of an incoming web request into a fixed-size memory buffer, but only stops copying when it hits a “?” character or the end of the string - never checking whether the data actually fits. Send it something too long, and it overflows the buffer, corrupting adjacent memory on the stack. That’s the textbook definition of a stack-based buffer overflow, and depending on how it’s exploited, it can crash the device or potentially let an attacker run their own code on it.
What makes this particularly nasty, if accurate, is that the affected endpoint - /cgi-bin/mbox-config/ - reportedly doesn’t check whether you’re logged in first. In other words, the researcher’s writeup claims no username, password or authentication token is needed to trigger it; a specially crafted request sent to the router is apparently enough. That’s the kind of detail that pushes a bug’s severity rating sky-high.
So who is actually at risk
This is where a bit of scepticism is useful. The vulnerability is specific to one router model - the Comfast CF-N1-S V2 - running one particular firmware version, 2.6.0.1. Comfast is a budget networking brand best known in China and among small businesses and DIY networking enthusiasts elsewhere; it’s not a household name on UK high streets, though its kit does turn up via online marketplaces.
Three things NerdBite would normally want nailed down before calling this urgent - and none of them are confirmed in the NVD entry or the GitHub report:
- Is it patched? There’s no mention of a fixed firmware version being available.
- Is it being exploited in the wild? No evidence of active attacks has been published.
- How many devices are actually affected? No install-base figures exist publicly.
A CVSS score of 10 tells you how bad the bug is in theory - unauthenticated, remotely triggerable, running with high impact - not how many real people are exposed to it right now. Plenty of maximum-severity CVEs affect a tiny number of niche or discontinued devices.
What to do about it
If you don’t own a Comfast CF-N1-S router, this simply isn’t your problem. If you do, or you manage a network that includes one, the sensible steps are the boring ones: check Comfast’s support channels for a firmware update, and in the meantime avoid exposing the router’s web management interface to the open internet - it should never have been reachable from outside your network in the first place.
The takeaway
This is a genuinely serious flaw for the specific hardware it affects, but “critical severity” describes the bug’s mechanics, not a mass-market crisis. Unless you can find your router model on this list, there’s nothing to act on here beyond the usual advice: keep firmware updated and don’t put admin panels on the public internet.