Description
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-21
Score: 5.1 Medium
EPSS: 2.1% Low
KEV: No
Impact: Remote Command Execution
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a command injection caused by inadequate validation of the "mac" argument in the send_order.cgi interface. By manipulating this parameter, an attacker can execute arbitrary shell commands on the router, potentially achieving full compromise of the device. This flaw represents a classic command injection weakness (CWE‑74) combined with improper input validation (CWE‑77).

Affected Systems

Chengdu Feiyuxing Technology’s Feiyu Star Router model B‑MB5E202‑210322‑r11656 is affected; no other firmware or variant versions are indicated, which implies any device running that exact firmware or containing the vulnerable component may be at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score of 2% indicates a low, but non-zero, exploitation probability. The vulnerability is not listed in CISA KEV, but public exploit releases raise concern. The likely attack vector is remote over HTTP, with an attacker able to trigger the injection by sending a crafted request to /send_order.cgi’s mac parameter from an allowed network.

Generated by OpenCVE AI on September 21, 2026 at 15:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict network access to the router’s management interface so that only trusted hosts can reach the /send_order.cgi endpoint.
  • Apply a firewall or reverse‑proxy rule to block or sanitize the mac parameter, preventing arbitrary shell command execution via this interface.
  • Monitor the vendor’s security advisories for a firmware patch and install it immediately when available.

Generated by OpenCVE AI on September 21, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection
First Time appeared Chengdu Feiyuxing Technology
Chengdu Feiyuxing Technology feiyu Star Router
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:h:chengdu_feiyuxing_technology:feiyu_star_router:*:*:*:*:*:*:*:*
Vendors & Products Chengdu Feiyuxing Technology
Chengdu Feiyuxing Technology feiyu Star Router
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Chengdu Feiyuxing Technology Feiyu Star Router
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-21T15:58:11.138Z

Reserved: 2026-09-20T19:38:20.300Z

Link: CVE-2026-94138

cve-icon Vulnrichment

Updated: 2026-09-21T15:58:05.020Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T04:17:37.083

Modified: 2026-09-21T16:17:29.030

Link: CVE-2026-94138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T15:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')