CVE-2026-94139
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. The affected file is /send_order.cgi?parameter=loginout in the Cookie Handler component, where manipulation of the session_id argument causes command injection. Remote exploitation is possible and the exploit is publicly available.
Risk Assessment
Command injection could allow a remote attacker to execute arbitrary system commands on the device, potentially leading to full device compromise and network integrity breach.
Recommendation
Immediately check for and apply firmware updates from the vendor. If unavailable, restrict external access to the device and monitor logs for suspicious activity.
Other vulnerabilities in Feiyu Star Router
Original NVD description (English source)
A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_order.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument session_id causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS