CVE-2026-124580— Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection

Quick assessment

Affected

Chengdu Feiyuxing Technology VW2100

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在成都飞宇星科技（Chengdu Feiyuxing Technology）的 VW2100 和 VEC10GP 1.0（固件版本 B-MB3W202-210825-r11775）中发现了一个漏洞。该漏洞影响 Weixin Auth Endpoint 组件中位于 var/html/webserver 文件的 handle_wechat_cn_wifi 函数。攻击者可通过操纵 extend 参数触发操作系统命令注入。此攻击可远程执行。利用代码已被公开，且可被实际利用。厂商在披露初期即被联系，但至今未作出任何回应。

CVSS 10.0 · Critical Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Chengdu Feiyuxing Technology	VW2100	1.0 B-MB3W202-210825-r11775	`cpe:2.3:a:chengdu_feiyuxing_technology:vw2100::::::::`
Chengdu Feiyuxing Technology	VEC10GP	1.0 B-MB3W202-210825-r11775	`cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp::::::::`