rootpwn

medium · CVSS v3 6.6 · CVSS v4 5.1 · EPSS 0.02055

CVE-2026-94138

Command injection vulnerability in Feiyu Star Router B-MB5E202-210322-r11656 via /send_order.cgi?parameter=del_expmac. Remote attacker can i

Overview

Command injection vulnerability in Feiyu Star Router B-MB5E202-210322-r11656 via /send_order.cgi?parameter=del_expmac. Remote attacker can inject arbitrary commands, enabling full compromise of the device.

Description

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: attacker can read sensitive configuration. Integrity: attacker can modify or delete data. Availability: attacker can disrupt router operation. Network administrators and end users of affected routers are at risk.

Remediation

Apply vendor-supplied firmware update that removes command injection. If no patch, disable the /send_order.cgi endpoint or block access via firewall. Ensure router firmware is up-to-date and restrict management interface to local network only.

Risk context

Medium severity (CVSS 6.6) with low EPSS (0.02055). While not highly likely to be targeted, the vulnerability can be exploited remotely and may lead to full device compromise. Defenders should prioritize patching.

Affected products

  • Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656

Scores

Severity
medium
CVSS v2
5.8
CVSS v3
6.6
CVSS v4
5.1
EPSS
0.02055

command-injection router remote-execution firmware network-security

← All CVEs

Related CVEs

medium

CVE-2026-94210

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

View analysis

medium

CVE-2026-94094

OpenClaw up to 2026.9.5 has a denial‑of‑service flaw in the Canvas Host Route that allows remote attackers to crash the server by sending a crafted request that forces the entire file to be buffered. The vulnerability can cause the OpenClaw service to become unresponsive, impacting availability for users and administrators.

View analysis

medium

CVE-2026-94102

WuzhiCMS versions up to 4.1.0 allow an attacker to trigger an open redirect via the Login component by manipulating the forward argument in /index.php?m=member&v=Login. The flaw can be exploited remotely without authentication and may be used to redirect users to malicious sites.

View analysis

medium

CVE-2026-94137

A local denial‑of‑service vulnerability exists in Hangzhou Shunwang Technology’s shzh 10.7.2.693 driver. The flaw is in the shdrv_x64.sys IRP_MJ_DEVICE_CONTROL handler and can be triggered by manipulating the PID argument. Successful exploitation can cause the driver to crash, disrupting system stability.

View analysis