CVE-2026-94138

MediumCVSS 6.6

Published: 21/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.06%

80th percentile - higher than 80% of all known CVEs

Summary

A vulnerability was discovered in the Feiyu Star Router B-MB5E202-210322-r11656 (Chengdu Feiyuxing Technology) in /send_order.cgi?parameter=del_expmac. Manipulation of the mac argument leads to command injection. The attack can be launched remotely and the exploit has been publicly released.

Risk Assessment

A remote attacker can execute arbitrary system commands on the device, taking full control. The public exploit increases the risk of active attacks.

Recommendation

Update the Feiyu Star router firmware to the vendor-patched version or restrict management interface access to trusted networks only.

Other vulnerabilities in Feiyu Star Router

CVE-2026-94139High
A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. The affected file is /send_order.cgi?parameter=loginout in the Cookie Handler component, where manipulation of the session_id argument causes command injection. Remote exploitation is possible and the exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS