---
id: "CVE-2026-124580"
page: "https://infrastack.ai/live/CVE-2026-124580"
kind: "vulnerability"
aliases: ["CVE-2026-124580"]
title: "Chengdu Feiyuxing VW2100 router: remote command injection via Weixin login"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "VW2100", "fixed": [], "affected": "1.0 B-MB3W202-210825-r11775", "ecosystem": "vendor"}, {"name": "VEC10GP", "fixed": [], "affected": "1.0 B-MB3W202-210825-r11775", "ecosystem": "vendor"}]
ecosystems: []
tags: ["chengdu-feiyuxing", "embedded-firmware", "infrastructure", "router", "wifi-portal"]
not_affected_if: ["other-firmware-versions", "weixin-portal-disabled"]
published_at: "2026-11-09T08:17:02+00:00"
first_seen_at: "2026-11-09T08:25:21+00:00"
updated_at: "2026-11-09T08:27:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124580", "first_seen_at": "2026-11-09T08:25:21+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124580", "first_seen_at": "2026-11-09T08:27:19+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124580"]}]
exploit_sources: []
---

# Chengdu Feiyuxing VW2100 router: remote command injection via Weixin login

Link for people: https://infrastack.ai/live/CVE-2026-124580 (this .md is for agents)

The Chengdu Feiyuxing VW2100 and VEC10GP 1.0 device firmware passes the extend argument of its Weixin authentication endpoint to an operating system command without checking it. A remote attacker can run commands on the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VW2100 affected 1.0 B-MB3W202-210825-r11775 fixed no fixed version listed
- vendor:VEC10GP affected 1.0 B-MB3W202-210825-r11775 fixed no fixed version listed

## How to check

- Check whether the device runs firmware `B-MB3W202-210825-r11775` (unknown whether the version string is shown in the admin interface)
- Check whether the Weixin Wi-Fi authentication portal is enabled on the device

## Timeline

- 2026-11-09T08:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124580
- 2026-11-09T08:27:19+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124580 — Only NVD record read (description via collector). web-cli out of Exa credits, NVD page not renderable by WebFetch; no vendor page, PoC link, or fix found. Vendor reportedly did not respond. Nothing verified. Revisit when search works to find PoC link and confirm default reachability.

## Documents

- [describes] NVD CVE-2026-124580 https://nvd.nist.gov/vuln/detail/CVE-2026-124580

## From the sources

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_