CVE-2026-124580

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124580", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-08T17:10:33.059Z", "datePublished": "2026-11-09T08:00:24.210Z", "dateUpdated": "2026-11-12T19:45:55.444Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-09T08:00:24.210Z"}, "title": "Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "Chengdu Feiyuxing Technology", "product": "VW2100", "versions": [{"version": "1.0 B-MB3W202-210825-r11775", "status": "affected"}], "cpes": ["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"], "modules": ["Weixin Auth Endpoint"]}, {"vendor": "Chengdu Feiyuxing Technology", "product": "VEC10GP", "versions": [{"version": "1.0 B-MB3W202-210825-r11775", "status": "affected"}], "cpes": ["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"], "modules": ["Weixin Auth Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 10, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 10, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-11-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-08T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-08T18:15:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Walnut1337 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/432937", "name": "VDB-432937 | Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/432937/cti", "name": "VDB-432937 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-124580", "name": "CVE-2026-124580 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1038438", "name": "Submit #1038438 | Chengdu Feiyuxing Technology Co., Ltd. (\u6210\u90fd\u98de\u9c7c\u661f\u79d1\u6280; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS) B-MB3W202-210825-r11775 and earlier builds Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md", "tags": ["related"]}, {"url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T19:45:37.304334Z", "id": "CVE-2026-124580", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:45:55.444Z"}}]}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"], "modules": ["Weixin Auth Endpoint"], "product": "VW2100", "vendor": "Chengdu Feiyuxing Technology", "versions": [{"status": "affected", "version": "1.0 B-MB3W202-210825-r11775"}]}, {"cpes": ["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"], "modules": ["Weixin Auth Endpoint"], "product": "VEC10GP", "vendor": "Chengdu Feiyuxing Technology", "versions": [{"status": "affected", "version": "1.0 B-MB3W202-210825-r11775"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-124580", "lastModified": "2026-11-12T20:18:29.310", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-124580", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T19:45:37.304334Z", "version": "2.0.3"}}]}, "published": "2026-11-09T08:17:02.923", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-124580"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1038438"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/432937"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/432937/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0 B-MB3W202-210825-r11775"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VEC10GP", "source": "cna", "vendor": "Chengdu Feiyuxing Technology"}, "product": "vec10gp", "vendor": "chengdu_feiyuxing_technology"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0 B-MB3W202-210825-r11775"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VW2100", "source": "cna", "vendor": "Chengdu Feiyuxing Technology"}, "product": "vw2100", "vendor": "chengdu_feiyuxing_technology"}], "created": "2026-11-09T09:30:08.435432+00:00", "updated": "2026-11-09T16:37:04.206936+00:00", "vendors": ["chengdu_feiyuxing_technology", "chengdu_feiyuxing_technology$PRODUCT$vec10gp", "chengdu_feiyuxing_technology$PRODUCT$vw2100"]}