CVE-2026-124585 is a critical OS command injection flaw in the web admin interface of Chengdu Feiyuxing Technology's VW2100 and VEC10GP devices. VulDB reports that an exploit has been made public. The vendor has not responded.
What Is It
The flaw is in the add_expmac function of the var/html/webserver file, which is part of the Web Administration Interface. An attacker can manipulate the mac argument to inject operating system commands. VulDB is the CNA and classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The attack works remotely over the network. VulDB says the exploit has been made public, and the NVD references include a proof-of-concept script on GitHub.
Why It Matters
VulDB rates this flaw 9.9 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The attack has low complexity, needs only low privileges and requires no user interaction. The scope is changed, and the impact on confidentiality, integrity and availability is high in all three cases. The CVSS 4.0 score is 8.6 HIGH, with exploit maturity marked as Proof-of-Concept.
The vendor was contacted before disclosure but did not respond. Defenders therefore have no vendor guidance, even though exploit material has reportedly been released publicly.
As of this writing, the CVE does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. The available data does not confirm active exploitation in the wild. VulDB states that the exploit has been made public and NVD links to a proof-of-concept script. Neither source confirms that anyone has independently tested the PoC or that it works against deployed devices.
What's Vulnerable
- Chengdu Feiyuxing Technology VW2100, version 1.0 B-MB3W202-210825-r11775
- Chengdu Feiyuxing Technology VEC10GP, version 1.0 B-MB3W202-210825-r11775
- Affected component: Web Administration Interface
NVD published the record on 2026-11-09 and has set its status to "Deferred."
Patch Status
The available data lists no patch or fixed version. According to the disclosure, the vendor did not respond when the researcher made contact. The CVE has no entry in the CISA KEV catalog, so CISA has issued no required action or remediation deadline.