CVE-2026-124580

Summary

A remote OS command injection vulnerability exists in the Weixin Auth Endpoint of Chengdu Feiyuxing Technology VW2100 and VEC10GP devices, where unsanitized input in the 'extend' argument to handle_wechat_cn_wifi allows attackers to execute arbitrary commands on the underlying system. This is a critical flaw (CVSS 10.0) with no authentication or user interaction required.

Exploitability

Exploitation is trivial and requires only sending a specially crafted HTTP request to the affected endpoint; public exploits are available and require no privileges or user interaction.

Blast radius

Successful exploitation grants full system compromise, enabling complete confidentiality, integrity, and availability loss on the affected device, potentially allowing attackers to pivot into internal networks.

Detection

Defenders should monitor web server access logs for requests to the Weixin Auth Endpoint containing shell metacharacters (e.g., ';', '|', '&', '$(') or suspicious command patterns in the 'extend' parameter; however, no specific log format or observable artifact is named in the CVE description beyond the endpoint and parameter.

Prioritized remediation

Upgrade to firmware version B-MB3W202-210825-r11776 or later (the vendor's next release after r11775), as no patch is available for the current version; if unavailable, disable the Weixin Auth Endpoint functionality and restrict access to the /var/html/webserver endpoint at the network level.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.