Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-124585 (GCVE-0-2026-124585)

Vulnerability from cvelistv5 – Published: 2026-11-09 09:00 – Updated: 2026-11-09 09:00

Title

Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection

Summary

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

CWE

CWE-78 - OS Command Injection
CWE-77 - Command Injection

Assigner

VulDB CNA

References

5 references

URL	Tags
https://vuldb.com/vuln/433009	vdb-entrytechnical-description
https://vuldb.com/vuln/433009/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124585	third-party-advisory
https://vuldb.com/submit/1039019	third-party-advisory
https://github.com/C0KE/Feiyuxing-VROS-add_expmac…	exploit

Impacted products

2 products

Vendor	Product	Version
Chengdu Feiyuxing Technology	VW2100	Affected: 1.0 B-MB3W202-210825-r11775 cpe:2.3:a:chengdu_feiyuxing_technology:vw2100::::::::
Chengdu Feiyuxing Technology	VEC10GP	Affected: 1.0 B-MB3W202-210825-r11775 cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp::::::::

Credits

coke (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Web Administration Interface"
          ],
          "product": "VW2100",
          "vendor": "Chengdu Feiyuxing Technology",
          "versions": [
            {
              "status": "affected",
              "version": "1.0 B-MB3W202-210825-r11775"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Web Administration Interface"
          ],
          "product": "VEC10GP",
          "vendor": "Chengdu Feiyuxing Technology",
          "versions": [
            {
              "status": "affected",
              "version": "1.0 B-MB3W202-210825-r11775"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "coke (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 9,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T09:00:27.764Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433009 | Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/433009"
        },
        {
          "name": "VDB-433009 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433009/cti"
        },
        {
          "name": "CVE-2026-124585 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124585"
        },
        {
          "name": "Submit #1039019 | Chengdu Feiyuxing Technology Co., Ltd. (\u6210\u90fd\u98de\u9c7c\u661f\u79d1\u6280; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS)  B-MB3W202-210825-r11775 Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1039019"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T21:24:34.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124585",
    "datePublished": "2026-11-09T09:00:27.764Z",
    "dateReserved": "2026-11-08T20:19:28.607Z",
    "dateUpdated": "2026-11-09T09:00:27.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124580 (GCVE-0-2026-124580)

Vulnerability from cvelistv5 – Published: 2026-11-09 08:00 – Updated: 2026-11-09 08:00

Title

Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection

Summary

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

10 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

10 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

CWE

CWE-78 - OS Command Injection
CWE-77 - Command Injection

Assigner

VulDB CNA

References

6 references

URL	Tags
https://vuldb.com/vuln/432937	vdb-entrytechnical-description
https://vuldb.com/vuln/432937/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124580	third-party-advisory
https://vuldb.com/submit/1038438	third-party-advisory
https://github.com/Walnut1337/Feiyuxing_VROS_comm…	related
https://github.com/Walnut1337/Feiyuxing_VROS_comm…	exploit

Impacted products

2 products

Vendor	Product	Version
Chengdu Feiyuxing Technology	VW2100	Affected: 1.0 B-MB3W202-210825-r11775 cpe:2.3:a:chengdu_feiyuxing_technology:vw2100::::::::
Chengdu Feiyuxing Technology	VEC10GP	Affected: 1.0 B-MB3W202-210825-r11775 cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp::::::::

Credits

Walnut1337 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Weixin Auth Endpoint"
          ],
          "product": "VW2100",
          "vendor": "Chengdu Feiyuxing Technology",
          "versions": [
            {
              "status": "affected",
              "version": "1.0 B-MB3W202-210825-r11775"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Weixin Auth Endpoint"
          ],
          "product": "VEC10GP",
          "vendor": "Chengdu Feiyuxing Technology",
          "versions": [
            {
              "status": "affected",
              "version": "1.0 B-MB3W202-210825-r11775"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Walnut1337 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 10,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T08:00:24.210Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432937 | Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432937"
        },
        {
          "name": "VDB-432937 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432937/cti"
        },
        {
          "name": "CVE-2026-124580 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124580"
        },
        {
          "name": "Submit #1038438 | Chengdu Feiyuxing Technology Co., Ltd. (\u6210\u90fd\u98de\u9c7c\u661f\u79d1\u6280; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS) B-MB3W202-210825-r11775  and earlier builds Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1038438"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T18:15:55.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124580",
    "datePublished": "2026-11-09T08:00:24.210Z",
    "dateReserved": "2026-11-08T17:10:33.059Z",
    "dateUpdated": "2026-11-09T08:00:24.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

2 vulnerabilities found for VW2100 by Chengdu Feiyuxing Technology

CVE-2026-124585 (GCVE-0-2026-124585)

CVE-2026-124580 (GCVE-0-2026-124580)