CVE-2026-124580
Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-78 CWE-77 |
| Vendor | chengdu feiyuxing technology |
| Product | vw2100 |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for chengdu feiyuxing technology vw2100
Be the first to know when new critical vulnerabilities affecting chengdu feiyuxing technology vw2100 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Chengdu Feiyuxing Technology / VW2100
1.0 B-MB3W202-210825-r11775
Chengdu Feiyuxing Technology / VEC10GP
1.0 B-MB3W202-210825-r11775
References
vuldb.com: https://vuldb.com/vuln/432937 vuldb.com: https://vuldb.com/vuln/432937/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124580 vuldb.com: https://vuldb.com/submit/1038438 github.com: https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md github.com: https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py
Credits
🔍 Walnut1337 (VulDB User) VulDB CNA Team