{"id":"CVE-2026-124585","published":"2026-11-09T09:16:59.517","lastModified":"2026-11-09T09:16:59.680","description":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-124585","tags":[]},{"url":"https://vuldb.com/submit/1039019","tags":[]},{"url":"https://vuldb.com/vuln/433009","tags":[]},{"url":"https://vuldb.com/vuln/433009/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw exists in the web administration interface of Chengdu Feiyuxing Technology VW2100 and VEC10GP devices, where unsanitized input to the add_expmac function allows attackers to execute arbitrary OS commands. This is a critical remote code execution (RCE) vulnerability with full confidentiality, integrity, and availability impact.","exploitability":"Exploitation requires low skill and only low-privileged network access (authenticated user), with no user interaction needed; public exploits are available.","blast_radius":"Successful exploitation grants full control of the affected embedded device, enabling lateral movement within industrial or network infrastructure, data exfiltration, or service disruption.","remediation":"No fixed version is published by the vendor; immediately disable the web administration interface or restrict access to the /var/html/webserver/add_expmac endpoint via network segmentation and firewall rules until patching is available.","detection":"Look for HTTP POST requests to /var/html/webserver/add_expmac containing shell metacharacters (e.g., semicolons, pipes, backticks) or unexpected command-like strings in the 'mac' parameter within web server access logs; also monitor for subsequent process creation events (e.g., /bin/sh, /bin/bash, wget, curl) from the webserver process on the device.","tags":["rce","command-injection","web-interface","ics","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:42:42.708Z"}}