VW2100 · CVE-2026-124585 · Infrastructure
NO FIX YET
The web administration interface of Chengdu Feiyuxing VW2100 and VEC10GP 1.0 devices does not sanitize the mac argument of the add_expmac function, so input is passed to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit exists.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices running the Feiyuxing VW2100 or VEC10GP 1.0 firmware build B-MB3W202-210825-r11775 are exposed when their web administration interface accepts requests from the attacker's network. Teams that run these devices should look at any that expose the web administration interface beyond a trusted management network. The vendor did not respond to disclosure, so no fixed firmware is stated by the sources, and devices not running this build or not exposing the web interface are less likely to be affected.
Not affected if admin-interface-not-exposed, different-firmware
Who cares feiyuxing, iot, routers, vec10gp, vw2100, web-admin
B-MB3W202-210825-r11775 in the web administration interface or on the device labelNo fix yet, per the sources.
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.