rootpwn

high · CVSS v3 7.4 · CVSS v4 5.3 · EPSS 0.01158

CVE-2026-94139

A command injection flaw exists in the Cookie Handler of Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 via the /sen

Overview

A command injection flaw exists in the Cookie Handler of Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 via the /send_order.cgi?parameter=loginout endpoint. Attackers can remotely inject OS commands by manipulating the session_id parameter. The vulnerability is publicly exploitable and the vendor has not released a fix.

Description

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_order.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument session_id causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: attackers can read or modify router configuration. Integrity: arbitrary commands can be executed, potentially altering firmware or network settings. Availability: the router may become unresponsive or reboot. Network administrators and end users of affected routers are at risk.

Remediation

1. Apply the vendor’s firmware update once released. 2. If no patch is available, disable remote management or block access to /send_order.cgi via firewall or ACL. 3. Restrict the session_id parameter to alphanumeric values and enforce input validation. 4. Monitor logs for anomalous command execution patterns.

Risk context

The vulnerability is rated high with a CVSS v3 score of 7.4 and an EPSS of 0.01158, indicating a moderate likelihood of exploitation. Immediate action is advised to mitigate potential remote command execution.

Affected products

  • Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656

Scores

Severity
high
CVSS v2
6.5
CVSS v3
7.4
CVSS v4
5.3
EPSS
0.01158

command-injection router remote-exploitation firmware network-security high-severity EPSS

← All CVEs

Related CVEs

high

CVE-2026-94144

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-94143

The drogonframework up to version 1.9.13 contains a SQL injection vulnerability in Mapper::orderBy that can be triggered remotely via manipulated sort arguments. This flaw is publicly known and could allow attackers to read, modify, or delete database contents.

View analysis

high

CVE-2026-94184

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.

View analysis

high

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

View analysis