CVE-2026-124585— Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection

Quick assessment

Affected

Chengdu Feiyuxing Technology VW2100

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在成都飞宇星科技 VW2100 和 VEC10GP 1.0（固件版本 B-MB3W202-210825-r11775）中发现一处漏洞。该问题影响 Web 管理界面组件中 var/html/webserver 文件内的 add_expmac 函数。对 mac 参数的恶意篡改可导致操作系统命令注入。攻击者可从远程发起攻击。利用代码已公开并可被利用。厂商已在此漏洞披露初期被联系，但至今未作出任何回应。

CVSS 9.9 · Critical Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Chengdu Feiyuxing Technology	VW2100	1.0 B-MB3W202-210825-r11775	`cpe:2.3:a:chengdu_feiyuxing_technology:vw2100::::::::`
Chengdu Feiyuxing Technology	VEC10GP	1.0 B-MB3W202-210825-r11775	`cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp::::::::`