VW2100 · CVE-2026-124580 · Infrastructure
NO FIX YET
The Chengdu Feiyuxing VW2100 and VEC10GP 1.0 device firmware passes the extend argument of its Weixin authentication endpoint to an operating system command without checking it. A remote attacker can run commands on the device, and a public exploit exists.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices running VW2100 or VEC10GP 1.0 firmware B-MB3W202-210825-r11775 that expose the Weixin authentication endpoint are affected. The sources do not say whether the endpoint is reachable by default or only with the Weixin portal enabled. The vendor did not respond to disclosure, and no fixed version is stated.
Not affected if other-firmware-versions, weixin-portal-disabled
Who cares chengdu-feiyuxing, embedded-firmware, router, wifi-portal
B-MB3W202-210825-r11775 (unknown whether the version string is shown in the admin interface)Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.