---
id: "CVE-2026-124585"
page: "https://infrastack.ai/live/CVE-2026-124585"
kind: "vulnerability"
aliases: ["CVE-2026-124585"]
title: "Feiyuxing VW2100 and VEC10GP routers: web admin flaw allows remote command injection"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "VW2100", "fixed": [], "affected": "1.0 B-MB3W202-210825-r11775", "ecosystem": "vendor"}, {"name": "VEC10GP", "fixed": [], "affected": "1.0 B-MB3W202-210825-r11775", "ecosystem": "vendor"}]
ecosystems: []
tags: ["feiyuxing", "infrastructure", "iot", "routers", "vec10gp", "vw2100", "web-admin"]
not_affected_if: ["admin-interface-not-exposed", "different-firmware"]
published_at: "2026-11-09T09:16:59+00:00"
first_seen_at: "2026-11-09T09:25:32+00:00"
updated_at: "2026-11-09T09:32:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124585", "first_seen_at": "2026-11-09T09:25:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T09:32:13+00:00"}]
exploit_sources: []
---

# Feiyuxing VW2100 and VEC10GP routers: web admin flaw allows remote command injection

Link for people: https://infrastack.ai/live/CVE-2026-124585 (this .md is for agents)

The web administration interface of Chengdu Feiyuxing VW2100 and VEC10GP 1.0 devices does not sanitize the mac argument of the add_expmac function, so input is passed to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VW2100 affected 1.0 B-MB3W202-210825-r11775 fixed no fixed version listed
- vendor:VEC10GP affected 1.0 B-MB3W202-210825-r11775 fixed no fixed version listed

## How to check

- Look up the device model and firmware build `B-MB3W202-210825-r11775` in the web administration interface or on the device label
- Check whether the web administration interface is reachable from the internet or from untrusted networks

## Timeline

- 2026-11-09T09:25:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124585
- 2026-11-09T09:32:13+00:00 analyst — Only NVD text available (web-cli search out of Exa credits; NVD page not renderable). CNA VulDB vector has PR:L, so the web admin likely needs a low-privilege login; not confirmed from a primary page. NVD says vendor never responded, so no fix known. No vendor advisory or PoC link found; nothing marked verified. Revisit when search works to find the VulDB entry and PoC.

## From the sources

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_