{"id":"CVE-2026-124580","kind":"vulnerability","aliases":["CVE-2026-124580"],"related":[],"title":"Chengdu Feiyuxing VW2100 router: remote command injection via Weixin login","description":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Chengdu Feiyuxing VW2100 and VEC10GP 1.0 device firmware passes the extend argument of its Weixin authentication endpoint to an operating system command without checking it. A remote attacker can run commands on the device, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VW2100","fixed":[],"affected":"1.0 B-MB3W202-210825-r11775","ecosystem":"vendor"},{"name":"VEC10GP","fixed":[],"affected":"1.0 B-MB3W202-210825-r11775","ecosystem":"vendor"}],"ecosystems":[],"tags":["chengdu-feiyuxing","embedded-firmware","infrastructure","router","wifi-portal"],"not_affected_if":["other-firmware-versions","weixin-portal-disabled"],"how_to_check":"- Check whether the device runs firmware `B-MB3W202-210825-r11775` (unknown whether the version string is shown in the admin interface)\n- Check whether the Weixin Wi-Fi authentication portal is enabled on the device","fix":null,"status":"open","published_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:51+00:00","updated_at":"2026-11-09T08:27:19+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-09T08:25:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chengdu Feiyuxing VW2100 router: remote command injection via Weixin login","impact":"high","summary":"The Chengdu Feiyuxing VW2100 and VEC10GP 1.0 device firmware passes the extend argument of its Weixin authentication endpoint to an operating system command without checking it. A remote attacker can run commands on the device, and a public exploit exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["router","embedded-firmware","wifi-portal","chengdu-feiyuxing"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether the Weixin auth endpoint is reachable by default and whether any vendor firmware fix exists; check NVD and vendor pages for affected version scope.","how_to_check":"- Check whether the device runs firmware `B-MB3W202-210825-r11775` (unknown whether the version string is shown in the admin interface)\n- Check whether the Weixin Wi-Fi authentication portal is enabled on the device","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","weixin-portal-disabled"],"who_is_affected":"Devices running VW2100 or VEC10GP 1.0 firmware B-MB3W202-210825-r11775 that expose the Weixin authentication endpoint are affected. The sources do not say whether the endpoint is reachable by default or only with the Weixin portal enabled. The vendor did not respond to disclosure, and no fixed version is stated.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000782,"input_tokens":4638,"output_tokens":637,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the Weixin auth endpoint is reachable by default and whether any vendor firmware fix exists; check NVD and vendor pages for affected version scope.","search":"'-124580':13A,16A '-2026':12A,15A '1.0':36B,81C '210825':85C 'argument':42B,109C 'attack':58B,117C 'auth':103C 'authent':46B 'b':83C 'b-mb3w202':82C 'check':54B 'chengdu':1A,20B,31B,75C 'chengdu-feiyux':19B 'cn':93C 'command':6A,52B,61B,114C 'compon':101C 'contact':135C 'could':129C 'cve':11A,14A 'devic':37B,64B 'disclosur':139C 'earli':136C 'embed':23B 'embedded-firmwar':22B 'endpoint':47B,104C 'execut':120C 'exist':69B 'exploit':68B,123C 'extend':41B,110C 'feiyux':2A,21B,32B,76C 'file':97C 'firmwar':24B,38B 'found':73C 'function':90C 'handl':91C 'impact':88C 'infrastructur':25B 'inject':7A,115C 'login':10A 'made':126C 'manipul':106C 'mb3w202':84C 'oper':50B 'os':113C 'pass':39B 'portal':29B 'public':67B,127C 'r11775':86C 'remot':5A,57B,121C 'respond':143C 'result':111C 'router':4A,26B 'run':60B 'system':51B 'technolog':77C 'use':131C 'var/html/webserver':98C 'vec10gp':18A,35B,80C 'vendor':133C 'via':8A 'vulner':71C 'vw2100':3A,17A,33B,78C 'way':146C 'wechat':92C 'weixin':9A,45B,102C 'wifi':28B,94C 'wifi-port':27B 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Devices running VW2100 or VEC10GP 1.0 firmware B-MB3W202-210825-r11775 that expose the Weixin authentication endpoint are affected. The sources do not say whether the endpoint is reachable by default or only with the Weixin portal enabled. The vendor did not respond to disclosure, and no fixed version is stated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["vec10gp","vw2100"],"ptokens":["vec10gp","vw2100"],"labels":["chengdufeiyuxing","critical","embeddedfirmware","infrastructure","router","wifiportal"],"campaign_type":null,"search_a":"'-124580':13A,16A '-2026':12A,15A 'chengdu':1A 'command':6A 'cve':11A,14A 'feiyux':2A 'inject':7A 'login':10A 'remot':5A 'router':4A 'vec10gp':18A 'via':8A 'vw2100':3A,17A 'weixin':9A","search_b":"'1.0':36B 'argument':42B 'attack':58B 'authent':46B 'check':54B 'chengdu':20B,31B 'chengdu-feiyux':19B 'command':52B,61B 'devic':37B,64B 'embed':23B 'embedded-firmwar':22B 'endpoint':47B 'exist':69B 'exploit':68B 'extend':41B 'feiyux':21B,32B 'firmwar':24B,38B 'infrastructur':25B 'oper':50B 'pass':39B 'portal':29B 'public':67B 'remot':57B 'router':26B 'run':60B 'system':51B 'vec10gp':35B 'vw2100':33B 'weixin':45B 'wifi':28B 'wifi-port':27B 'without':53B","search_c":"'1.0':81C '210825':85C 'argument':109C 'attack':117C 'auth':103C 'b':83C 'b-mb3w202':82C 'chengdu':75C 'cn':93C 'command':114C 'compon':101C 'contact':135C 'could':129C 'disclosur':139C 'earli':136C 'endpoint':104C 'execut':120C 'exploit':123C 'extend':110C 'feiyux':76C 'file':97C 'found':73C 'function':90C 'handl':91C 'impact':88C 'inject':115C 'made':126C 'manipul':106C 'mb3w202':84C 'os':113C 'public':127C 'r11775':86C 'remot':121C 'respond':143C 'result':111C 'technolog':77C 'use':131C 'var/html/webserver':98C 'vec10gp':80C 'vendor':133C 'vulner':71C 'vw2100':78C 'way':146C 'wechat':92C 'weixin':102C 'wifi':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124580","severity":null,"published_at":"2026-11-09T08:17:02+00:00","modified_at":"2026-11-09T08:17:03+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124580:2259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124580","severity":null,"published_at":"2026-11-09T08:27:19+00:00","modified_at":"2026-11-09T08:27:19+00:00","first_seen_at":"2026-11-09T08:27:19+00:00","fetched_at":"2026-11-09T08:27:19+00:00","note":"Only NVD record read (description via collector). web-cli out of Exa credits, NVD page not renderable by WebFetch; no vendor page, PoC link, or fix found. Vendor reportedly did not respond. Nothing verified. Revisit when search works to find PoC link and confirm default reachability.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-124580"]}],"documents":[{"id":106567,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124580","title":"NVD CVE-2026-124580","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}