CRITICAL 9.3 NVD
CVE-2026-124580
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md
- https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.p
- https://vuldb.com/cve/CVE-2026-124580
- https://vuldb.com/submit/1038438
- https://vuldb.com/vuln/432937
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-09 via NVD.
Risk Timeline
CVE Disclosed2026-11-09 · 0 days ago
Remediation Resources
Official Advisory
vuldb.com/cve/CVE-2026-124580Official Advisory
vuldb.com/vuln/432937Analysis & PoC
vuldb.com/submit/1038438
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.