Feiyu Star Router CVE-2026-94139

Requires network access to the router's web management interface AND a low-privilege authenticated context (PR:L) to reach /send_order.cgi?parameter=loginout - the Cookie Handler processes the attacker-controlled session_id cookie, so the attacker must be able to submit a request that the device treats as an established/parseable session. No user interaction is needed (UI:N). Practical exposure is limited by: the management interface typically being LAN-facing rather than WAN-exposed by default, the authentication prerequisite, and the vulnerability being tied to a specific firmware build. On consumer routers, weak or default credentials frequently make the PR:L barrier trivial to satisfy.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) with an E:P (proof-of-concept) exploit maturity and a low 5.3 base score is internally inconsistent with the vulnerability class. The vendor rated all impact metrics as Low (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), but this is OS command injection (CWE-77) on an embedded SOHO router, where injected shell commands typically execute as root within the router firmware - that warrants High confidentiality, integrity, and availability, not Low, materially understating true impact (my reassessment ~8.8 CVSS 3.1). The realistic exploitation gate is PR:L: an attacker needs some authenticated foothold (session/cookie context) to reach /send_order.cgi, which lowers priority versus a truly pre-auth RCE. Signals conflict: a publicly available PoC (VulDB/Feishu) raises actionability, but there is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation. Net: a legitimately serious code-execution flaw whose vendor score understates technical impact, but real-world priority is tempered by the authentication requirement and the product's small, niche deployment footprint. Exploitation status: publicly available exploit code exists (no KEV).

An attacker with a low-privilege authenticated session against the router's web management interface sends a crafted request to /send_order.cgi?parameter=loginout with shell metacharacters injected into the session_id cookie value, which the Cookie Handler passes unsanitized into a system command. A public proof-of-concept exists (VulDB/Feishu), so the attacker can execute arbitrary OS commands - likely as root - to seize full control of the router. Given PR:L, the attacker first needs valid or acquired management access, but on a SOHO device default/weak credentials often make that trivial.