{"id":"CVE-2026-124585","kind":"vulnerability","aliases":["CVE-2026-124585"],"related":[],"title":"Feiyuxing VW2100 and VEC10GP routers: web admin flaw allows remote command injection","description":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The web administration interface of Chengdu Feiyuxing VW2100 and VEC10GP 1.0 devices does not sanitize the mac argument of the add_expmac function, so input is passed to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit exists.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VW2100","fixed":[],"affected":"1.0 B-MB3W202-210825-r11775","ecosystem":"vendor"},{"name":"VEC10GP","fixed":[],"affected":"1.0 B-MB3W202-210825-r11775","ecosystem":"vendor"}],"ecosystems":[],"tags":["feiyuxing","infrastructure","iot","routers","vec10gp","vw2100","web-admin"],"not_affected_if":["admin-interface-not-exposed","different-firmware"],"how_to_check":"- Look up the device model and firmware build `B-MB3W202-210825-r11775` in the web administration interface or on the device label\n- Check whether the web administration interface is reachable from the internet or from untrusted networks","fix":null,"status":"open","published_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","triaged_at":"2026-11-09T09:26:13+00:00","updated_at":"2026-11-09T09:32:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T09:26:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Feiyuxing VW2100 and VEC10GP routers: web admin flaw allows remote command injection","impact":"high","summary":"The web administration interface of Chengdu Feiyuxing VW2100 and VEC10GP 1.0 devices does not sanitize the mac argument of the add_expmac function, so input is passed to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["feiyuxing","vw2100","vec10gp","routers","iot","web-admin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the device remotely.","analyst_note":"Confirm whether the web administration interface requires authentication and whether the vendor has issued any firmware fix; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124585.","how_to_check":"- Look up the device model and firmware build `B-MB3W202-210825-r11775` in the web administration interface or on the device label\n- Check whether the web administration interface is reachable from the internet or from untrusted networks\n- unknown for a vendor-supplied check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["admin-interface-not-exposed","different-firmware"],"who_is_affected":"Devices running the Feiyuxing VW2100 or VEC10GP 1.0 firmware build B-MB3W202-210825-r11775 are exposed when their web administration interface accepts requests from the attacker's network. Teams that run these devices should look at any that expose the web administration interface beyond a trusted management network. The vendor did not respond to disclosure, so no fixed firmware is stated by the sources, and devices not running this build or not exposing the web interface are less likely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000824,"input_tokens":4627,"output_tokens":723,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the web administration interface requires authentication and whether the vendor has issued any firmware fix; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124585.","search":"'-124585':15A,18A '-2026':14A,17A '1.0':40B,90C '210825':94C 'add':50B,101C 'admin':7A,29B 'administr':32B,111C 'affect':98C 'allow':9A 'arbitrari':67B 'argument':47B,117C 'attack':64B,125C 'b':92C 'b-mb3w202':91C 'chengdu':35B,84C 'command':11A,70B,122C 'compon':109C 'contact':144C 'could':138C 'cve':13A,16A 'devic':41B,73B 'disclosur':148C 'earli':145C 'exist':78B 'exploit':77B,132C 'expmac':51B,102C 'feiyux':1A,21B,36B,85C 'file':105C 'flaw':8A 'found':82C 'function':52B,100C 'infrastructur':22B 'inject':12A,123C 'input':54B 'interfac':33B,112C 'iot':23B 'issu':97C 'mac':46B,118C 'made':135C 'manipul':114C 'may':126C 'mb3w202':93C 'oper':59B,68B 'os':121C 'pass':56B 'perform':128C 'public':76B,136C 'r11775':95C 'remot':10A,63B,130C 'respond':152C 'result':119C 'router':5A,24B 'run':66B 'sanit':44B 'shell':61B 'system':60B,69B 'technolog':86C 'use':140C 'var/html/webserver':106C 'vec10gp':4A,20A,25B,39B,89C 'vendor':142C 'vulner':80C 'vw2100':2A,19A,26B,37B,87C 'way':155C 'web':6A,28B,31B,110C 'web-admin':27B","nicknames":[],"mitigations":[],"who_affected":"Devices running the Feiyuxing VW2100 or VEC10GP 1.0 firmware build B-MB3W202-210825-r11775 are exposed when their web administration interface accepts requests from the attacker's network. Teams that run these devices should look at any that expose the web administration interface beyond a trusted management network. The vendor did not respond to disclosure, so no fixed firmware is stated by the sources, and devices not running this build or not exposing the web interface are less likely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vec10gp","vw2100"],"ptokens":["vec10gp","vw2100"],"labels":["critical","feiyuxing","infrastructure","iot","routers","vec10gp","vw2100","webadmin"],"campaign_type":null,"search_a":"'-124585':15A,18A '-2026':14A,17A 'admin':7A 'allow':9A 'command':11A 'cve':13A,16A 'feiyux':1A 'flaw':8A 'inject':12A 'remot':10A 'router':5A 'vec10gp':4A,20A 'vw2100':2A,19A 'web':6A","search_b":"'1.0':40B 'add':50B 'admin':29B 'administr':32B 'arbitrari':67B 'argument':47B 'attack':64B 'chengdu':35B 'command':70B 'devic':41B,73B 'exist':78B 'exploit':77B 'expmac':51B 'feiyux':21B,36B 'function':52B 'infrastructur':22B 'input':54B 'interfac':33B 'iot':23B 'mac':46B 'oper':59B,68B 'pass':56B 'public':76B 'remot':63B 'router':24B 'run':66B 'sanit':44B 'shell':61B 'system':60B,69B 'vec10gp':25B,39B 'vw2100':26B,37B 'web':28B,31B 'web-admin':27B","search_c":"'1.0':90C '210825':94C 'add':101C 'administr':111C 'affect':98C 'argument':117C 'attack':125C 'b':92C 'b-mb3w202':91C 'chengdu':84C 'command':122C 'compon':109C 'contact':144C 'could':138C 'disclosur':148C 'earli':145C 'exploit':132C 'expmac':102C 'feiyux':85C 'file':105C 'found':82C 'function':100C 'inject':123C 'interfac':112C 'issu':97C 'mac':118C 'made':135C 'manipul':114C 'may':126C 'mb3w202':93C 'os':121C 'perform':128C 'public':136C 'r11775':95C 'remot':130C 'respond':152C 'result':119C 'technolog':86C 'use':140C 'var/html/webserver':106C 'vec10gp':89C 'vendor':142C 'vulner':80C 'vw2100':87C 'way':155C 'web':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T09:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124585","severity":null,"published_at":"2026-11-09T09:16:59+00:00","modified_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","fetched_at":"2026-11-09T09:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124585:2262","url":null,"severity":null,"published_at":"2026-11-09T09:32:13+00:00","modified_at":"2026-11-09T09:32:13+00:00","first_seen_at":"2026-11-09T09:32:13+00:00","fetched_at":"2026-11-09T09:32:13+00:00","note":"Only NVD text available (web-cli search out of Exa credits; NVD page not renderable). CNA VulDB vector has PR:L, so the web admin likely needs a low-privilege login; not confirmed from a primary page. NVD says vendor never responded, so no fix known. No vendor advisory or PoC link found; nothing marked verified. Revisit when search works to find the VulDB entry and PoC."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}