Critical OS Command Injection Vulnerability in Chengdu Feiyuxing VW2100

## Overview A critical vulnerability, CVE-2026-124580, affects the Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This flaw resides in the function handle_wechat_cn_wifi within the Weixin Auth Endpoint component. The vulnerability enables remote attackers to execute OS commands through manipulation of the argument 'extend'. ## Technical Details The vulnerability is classified with a CVSS score of 9.3, indicating its high severity. The flaw occurs in the file var/html/webserver. Attackers can exploit this vulnerability remotely, making it particularly dangerous for organizations using the affected products. The exploit has been publicly disclosed, increasing the urgency for mitigation. ## Impact Successful exploitation of CVE-2026-124580 allows attackers to execute arbitrary OS commands on the affected devices. This could lead to unauthorized access, data breaches, and further compromise of network integrity. Given the critical nature of this vulnerability, organizations must prioritize its remediation to safeguard their systems. ## Mitigation Defenders should immediately apply any available patches from Chengdu Feiyuxing Technology. If no patch is available, organizations should consider implementing network segmentation to limit exposure. Monitoring for unusual activity related to the affected systems is also recommended. Organizations should remain vigilant and be prepared to respond to potential exploitation attempts.