Feiyu Star Router
Monthly
Command injection in the Feiyu Star Router (Chengdu Feiyuxing Technology, firmware build B-MB5E202-210322-r11656) lets an attacker who can reach the device's web management interface run arbitrary commands on the underlying operating system by manipulating the session_id cookie handled by /send_order.cgi?parameter=loginout. Publicly available exploit code exists, giving attackers a ready reference implementation, while the vendor did not respond to the disclosure, so no vendor-released patch has been identified at time of analysis. The vendor's CVSS 4.0 base score of 5.3 is internally inconsistent with the flaw class; an independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning a low-privilege authenticated attacker over the network can achieve high confidentiality, integrity and availability impact on the device, with the practical caveat that the management interface is normally LAN-facing and default or weak consumer credentials frequently make the PR:L prerequisite trivial to satisfy.
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.
Command injection in the Feiyu Star Router (Chengdu Feiyuxing Technology, firmware build B-MB5E202-210322-r11656) lets an attacker who can reach the device's web management interface run arbitrary commands on the underlying operating system by manipulating the session_id cookie handled by /send_order.cgi?parameter=loginout. Publicly available exploit code exists, giving attackers a ready reference implementation, while the vendor did not respond to the disclosure, so no vendor-released patch has been identified at time of analysis. The vendor's CVSS 4.0 base score of 5.3 is internally inconsistent with the flaw class; an independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning a low-privilege authenticated attacker over the network can achieve high confidentiality, integrity and availability impact on the device, with the practical caveat that the management interface is normally LAN-facing and default or weak consumer credentials frequently make the PR:L prerequisite trivial to satisfy.
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.