CVE-2026-124580

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology VW2100 version 1.0 B-MB3W202-210825-r11775 Chengdu Feiyuxing Technology VEC10GP version 1.0 B-MB3W202-210825-r11775

Description An OS command injection flaw exists in the Weixin Auth Endpoint component within the var/html/webserver file. A remote attacker can exploit this by manipulating the extend argument passed to the handle wechat cn wifi() function, allowing for the execution of arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the handle wechat cn wifi() function to minimize the risk of exploitation.