CVE-2026-124585

Summary

A command injection flaw exists in the web administration interface of Chengdu Feiyuxing Technology VW2100 and VEC10GP devices, where unsanitized input to the add_expmac function allows attackers to execute arbitrary OS commands. This is a critical remote code execution (RCE) vulnerability with full confidentiality, integrity, and availability impact.

Exploitability

Exploitation requires low skill and only low-privileged network access (authenticated user), with no user interaction needed; public exploits are available.

Blast radius

Successful exploitation grants full control of the affected embedded device, enabling lateral movement within industrial or network infrastructure, data exfiltration, or service disruption.

Detection

Look for HTTP POST requests to /var/html/webserver/add_expmac containing shell metacharacters (e.g., semicolons, pipes, backticks) or unexpected command-like strings in the 'mac' parameter within web server access logs; also monitor for subsequent process creation events (e.g., /bin/sh, /bin/bash, wget, curl) from the webserver process on the device.

Prioritized remediation

No fixed version is published by the vendor; immediately disable the web administration interface or restrict access to the /var/html/webserver/add_expmac endpoint via network segmentation and firewall rules until patching is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.