CVE-2026-77004 is a pre-auth command injection in Comfast CF-N1-S firmware's mbox-config CGI endpoint. The vulnerability lives in how the 'sn' (serial number) parameter gets passed to sprintf and then to a shell command — a pattern where a configuration setting transparently becomes a system command argument. The CVSS 7.4 with Auth:N means exploitation requires no credentials at all, which is the critical detail that should drive prioritization.
The first question to answer operationally is whether this endpoint genuinely lacks authentication or whether the sn parameter was placed outside an auth gate that protects other mbox-config functions. This distinction matters enormously: an intentional provisioning path (designed for manufacturing or ISP activation before session establishment) is a fundamentally different vulnerability than an accidental authentication bypass. If this is a provisioning-adjacent design decision rather than an oversight, the same pattern likely exists on other parameters — the disclosure may be incomplete.
The second question is exposure. CF-N1-S targets ISP mesh deployments and WiFi extender infrastructure. If the management interface is WAN-accessible in default configurations (common in ISP-provisioned hardware that users never change), this pre-auth injection becomes internet-exploitable without credential theft or prior compromise. The deployment context changes the blast radius: a compromised network bridge node sits on the infrastructure path itself, not behind it, enabling upstream pivots into provisioning systems that traditional lateral movement would require.
Analysts should also consider the remediation timeline. Comfast doesn't push firmware directly — ISPs do, through their own provisioning infrastructure. The window between CVE publication and fleet-wide patching is multiplied by a distribution chain the vendor doesn't control. More critically, this vulnerability class has a documented recurrence pattern: vendors patch the specific parameter rather than the sprintf-to-shell architecture, leaving the underlying pattern intact. The fix should be inspected to confirm it changes the command construction model entirely, not just bounds-checks this parameter.
Finally, account for EOL trajectory. ISP mesh hardware gets replaced wholesale on refresh cycles, but the old units don't disappear securely — they resell, get repurposed, or sit in closets with default credentials active. The CVE doesn't expire when firmware updates stop, and the vulnerable code may persist in second-hand markets and asset disposal chains long after the vendor considers the issue closed.