CVE-2026-124585: Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function addexpmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected products are Chengdu Feiyuxing Technology VW2100 and VEC10GP running version 1.0 B-MB3W202-210825-r11775. Exposure requires the Web Administration Interface and its webserver component to be reachable by an attacker.
What level of access does an attacker need?
The listed vector requires network access and low privileges, with no user interaction. Exploitation involves controlling the mac argument passed to the add_expmac function.
Is public exploit information available?
Yes. A proof of concept is flagged, and the vulnerability description states that an exploit has been made public.
Is a vendor fix available?
The available data does not identify a fix. It states that the vendor was contacted before disclosure but did not respond.