CVE-2026-124585: Command Injection in Feiyuxing VW2100 / VEC10GP Web Interface
A critical vulnerability published to the NVD on 2026-11-09 affects Chengdu Feiyuxing Technology VW2100 and VEC10GP devices running firmware 1.0 B-MB3W202-210825-r11775. It is tracked as CVE-2026-124585 with a CVSS score of 9.9.
Technical Details
According to the NVD record, the flaw is in the add_expmac function of the var/html/webserver file, part of the Web Administration Interface. Manipulating the mac argument results in OS command injection: attacker-controlled input is passed to a system shell without adequate sanitisation.
The NVD description excerpt available when this advisory was written was truncated, so details such as attack vector, required privileges and any public exploit status should be confirmed against the full NVD entry.
Affected Products
| Product | Version |
|---|---|
| Chengdu Feiyuxing VW2100 | 1.0 B-MB3W202-210825-r11775 |
| Chengdu Feiyuxing VEC10GP | 1.0 B-MB3W202-210825-r11775 |
Impact
Successful exploitation of OS command injection on an embedded network device typically allows an attacker to:
- Execute arbitrary commands with the privileges of the web server process, often root on embedded firmware
- Change device configuration or pivot into the internal network
- Persist on the device or enlist it in a botnet
Recommended Actions
- Remove the web administration interface from untrusted networks and never expose it to the internet.
- Restrict management access to a dedicated management VLAN or VPN.
- Check with the vendor for a patched firmware release; none was referenced in the source data.
- Monitor for unexpected requests to the
add_expmachandler and unusual outbound connections from the device. - Consider replacing the device if the vendor does not provide a fix.