CVE-2026-124580: fallo crítico en Chengdu Feiyuxing Technology VW2100
Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 10epss 2.8%
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
PoCs públicas encontradas — 1
cve_referencegithub.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.pyno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Chengdu Feiyuxing Technology VW2100
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.pyhttps://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.mdhttps://vuldb.com/cve/CVE-2026-124580https://vuldb.com/submit/1038438https://vuldb.com/vuln/432937https://vuldb.com/vuln/432937/cti