A flaw in the handle_wechat_cn_wifi function of the Weixin Auth Endpoint allows an attacker who can manipulate the "extend" argument to inject operating system commands into the underlying webserver. The injected commands are executed with the privileges of the web server process, giving the attacker full control over the device. Affected users could compromise confidentiality, integrity, and availability of the device and any network resources it connects to.

Chengdu Feiyuxing Technology VEC10GP and VW2100 units, specifically the 1.0 B-MB3W202-210825-r11775 build. The vulnerability is present in the webserver component that exposes the Weixin Auth Endpoint, which is reachable from external networks.

The CVSS score of 10 highlights a critical severity level. The EPSS value is not available, but the vulnerability is publicly disclosed and could be exploited without any special conditions. The attack vector is remote, requiring only the ability to send crafted requests to the handle_wechat_cn_wifi endpoint. The vendor has not yet provided a fix or security advisory, and the vulnerability is not listed in the CISA KEV catalog. Given these factors, the risk of exploitation is high and urgent mitigation is required.