CVE-2026-124580 Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
CriticalCVSS 10.0
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chengdu feiyuxing technology vw2100 | = 1.0 B-MB3W202-210825-r11775 | No fix listed |
| chengdu feiyuxing technology vec10gp | = 1.0 B-MB3W202-210825-r11775 | No fix listed |
References
- VDB-432937 | Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection technical-description vdb-entry
- VDB-432937 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-required signature
- CVE-2026-124580 | CVE Analysis and Report third-party-advisory
- Submit #1038438 | Chengdu Feiyuxing Technology Co., Ltd. (成都飞鱼星科技; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS) B-MB3W202-210825-r11775 and earlier builds Command Injection third-party-advisory
- github.com related
- github.com exploit