OS Command Injection Vulnerability in Chengdu Feiyuxing Technology Products
CVE-2026-124585

9.4CRITICAL

Key Information:

Vendor: Chengdu Feiyuxing Technology
Status: Vw2100; Vec10gp
Vendor: CVE Published:; 9 November 2026

🔔 Create Chengdu Feiyuxing Technology Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124585?

A vulnerability exists in the web administration interface of Chengdu Feiyuxing Technology's VW2100 and VEC10GP products, specifically in the add_expmac function. This flaw allows an attacker to manipulate the 'mac' argument, leading to OS command injection. Due to the nature of the vulnerability, it can be exploited remotely, which poses a significant security risk. Although the vendor was informed about the issue, they did not provide a response, which increases the urgency for affected users to address this vulnerability.

Affected Version(s)

VEC10GP 1.0 B-MB3W202-210825-r11775

VW2100 1.0 B-MB3W202-210825-r11775

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124585 - Proof of Concept