EUVD-2026-83831
GHSA-q464-mhvm-j3j7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain router admin session (PR:H)
-
DeliverySend crafted /send_order.cgi del_expmac request
-
ExploitInject shell metacharacters in mac argument
-
ExecutionFirmware executes arbitrary OS commands
-
ImpactFull router compromise and LAN pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated router-administration session (CVSS PR:H) to reach the /send_order.cgi endpoint with parameter=del_expmac; exploitation then needs only injecting shell metacharacters into the 'mac' argument - no user interaction. Limiting factors: attacker must already hold admin-level access to the web management interface (frequently reachable via default/weak credentials on SOHO routers), the management interface must be network-reachable to the attacker, and it is confined to the specific firmware build B-MB5E202-210322-r11656. No unauthenticated path is documented. |
| Impact | This is a genuine but access-gated command-injection flaw whose real-world priority is moderate, not critical. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms remote, low-complexity reachability but requires HIGH privileges (PR:H) - meaning an authenticated router-admin session is a prerequisite, which substantially limits opportunistic mass exploitation. The vendor's own impact metrics (VC:L/VI:L/VA:L, score 5.1) understate the outcome: OS command injection on an embedded router (CWE-77) typically yields full root-level device control, so I assess impacts as High rather than Low. Signals are mixed: a public exploit exists (Feishu wiki write-up) and the flaw is trivially triggered once authenticated (E:P), yet there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation. The PR:H requirement plus the obscure Chinese SOHO-router target argues for targeted/opportunistic rather than widespread automated abuse. Net: real and reproducible, but gated by authentication and low deployment footprint - a solid patch-when-able rather than emergency item. Note the vendor did not respond to disclosure, so no official patch is confirmed. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed router admin credentials (default/weak creds are common on SOHO gear) sends a crafted request to /send_order.cgi?parameter=del_expmac with shell metacharacters in the mac argument, causing the firmware to execute arbitrary OS commands. Because command injection on embedded devices runs with high privilege, this yields full device takeover - enabling traffic interception, pivoting into the LAN, or persistent implantation. A public proof-of-concept exploit has been released (Feishu wiki), lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed firmware build is referenced in the available references (VulDB entries https://vuldb.com/vuln/408055 and https://vuldb.com/cve/CVE-2026-94138 document the flaw but supply no fix version). Because the injection is only reachable after authenticating to the web management interface (PR:H), the highest-value compensating control is to remove the exposure path: change the router's default administrative credentials immediately, restrict management access to a trusted LAN/VLAN segment, and disable WAN-side remote management so the HTTP interface is not internet-reachable - the trade-off is loss of convenient remote administration. Where the device must remain in service and untrusted users share the management network, place it behind a reverse proxy or WAF/IPS rule that inspects requests to /send_order.cgi and rejects any 'mac' argument containing shell metacharacters (semicolon, pipe, ampersand, backtick, $, newline); this blocks the documented vector but is signature-based and may be bypassed by encoding variations, so it should not be the sole defense. Log and alert on requests to /send_order.cgi?parameter=del_expmac so an injection attempt by a rogue or compromised admin account is at least detected. If the device cannot be hardened or segmented, the most reliable mitigation is replacement with a router model that receives vendor firmware updates, since an unpatched, vendor-abandoned build leaves the command-injection handler permanently exposed to anyone who obtains admin access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic OS command injection (CWE-77) in the embedded web management application of the Feiyu Star Router. The endpoint /send_order.cgi exposes an operation selected by the 'parameter' query string (here parameter=del_expmac, i.e. deleting an extended MAC address entry), and the user-supplied 'mac' value is passed into a shell invocation without adequate neutralization of control characters. When an attacker supplies shell metacharacters (for example a semicolon, pipe, or command substitution sequence) in that argument, the injected text is interpreted by the underlying OS shell running with the privileges of the CGI process - typically root on SOHO router firmware - converting a device-management function into arbitrary command execution. The CPE entry cpe:2.3:a:chengdu_feiyuxing_technology:feiyu_star_router:*:*:*:*:*:*:*:* uses a wildcard version, confirming that the vendor does not publish per-version CPE data; the reported firmware build B-MB5E202-210322-r11656 (dated 2021-03-22) is the confirmed affected release. The vulnerability is network-reachable through the HTTP management interface (CVSS AV:N) but is gated behind authenticated administrative access (PR:H), and the supplied CVSS v4.0 vector carries the E:P metric plus a public PoC, indicating exploit code is available rather than confirmed in-the-wild use. The associated /send_order.cgi action set is characteristic of OEM router web stacks that shell out for configuration tasks, a recurring pattern in this product class.
Know when Feiyu Star Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Remote, low-complexity injection but needs router-admin auth (PR:H); OS command execution on embedded firmware yields full device control, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB