CVE-2026-124580 Details
Description
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
An OS command injection vulnerability has been identified in Chengdu Feiyuxing Technology VW2100 and VEC10GP routers running VROS version 1.0 B-MB3W202-210825-r11775. The vulnerability resides in the Weixin Auth Endpoint, specifically within the handle_wechat_cn_wifi function of the webserver component. This issue allows for remote code execution as the root user.
To address this vulnerability, it is recommended to validate the 'extend' parameter as a MAC address and ensure that 'swifi_' arguments are well-formed IP or MAC values before processing. Additionally, avoid constructing shell commands from request data; instead, use 'execve()' with an argument vector. Restrict access to the web admin port to the local area network.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py | [email protected] | Exploit |
| https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md | [email protected] | BundleExploitRemedyTechnical Description |
| https://vuldb.com/cve/CVE-2026-124580 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1038438 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432937 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432937/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chengdu Feiyuxing Technology VW2100 | B-MB3W202-210825-r11775 |
CPE
Remediation
| |
| Chengdu Feiyuxing Technology VEC10GP | B-MB3W202-210825-r11775 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |