A critical, remotely exploitable OS command injection flaw in Chengdu Feiyuxing Technology's VW2100 and VEC10GP devices has a public proof-of-concept exploit. According to the VulDB disclosure, the vendor did not respond when contacted.
What Is It
CVE-2026-124580 is an OS command injection vulnerability (CWE-77, CWE-78) in the handle_wechat_cn_wifi function of var/html/webserver, part of the Weixin Auth Endpoint component. An attacker can inject OS commands through the extend argument. VulDB, the CNA, published the issue on 2026-11-09. NVD lists it as "Deferred."
Why It Matters
The CNA scores this as critical:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The attack works over the network, has low complexity, and needs no privileges or user interaction. According to the advisory, the exploit is public and could be used. The references include a PoC script (poc_weixin_auth.py) on GitHub.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, so the supplied data does not confirm active exploitation. A PoC is publicly available, though it has not been independently verified here. Because the attack also needs no authentication, the bar for exploitation is likely low.
What's Vulnerable
| Vendor | Product | Affected Version | Component |
|---|---|---|---|
| Chengdu Feiyuxing Technology | VW2100 | 1.0 B-MB3W202-210825-r11775 | Weixin Auth Endpoint |
| Chengdu Feiyuxing Technology | VEC10GP | 1.0 B-MB3W202-210825-r11775 | Weixin Auth Endpoint |
Patch Status
There is no patch or vendor advisory in the source data. According to the disclosure, the vendor was contacted early but did not respond. There is no CISA KEV entry, so no federal required action or due date applies. Until the vendor provides a fix, organizations running the affected firmware should treat these devices as exposed and limit network access to their web management and authentication interfaces.