Description

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-21T04:17:37.083Z",
  "pubdate": "2026-09-21T04:17:37.083Z",
  "executiveSummary": "A critical command injection vulnerability exists within the Chengdu Feiyuxing Technology Feiyu Star Router (firmware version B-MB5E202-210322-r11656).\nThe flaw resides in the /send_order.cgi script when processing the 'del_expmac' parameter, specifically through the improper sanitization of the 'mac' argument.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands with elevated privileges on the underlying operating system.\nSuccessful exploitation compromises the integrity, availability, and confidentiality of the device, effectively granting an attacker full control over the router's functionality and its role as a gateway.\nGiven that the exploit is publicly available and the vendor has remained unresponsive, the risk to affected devices is extreme.\nExposure of the administrative interface to the public internet exacerbates the risk, as it facilitates remote exploitation without the need for prior authentication or local network access.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw. It originates from the insufficient validation and sanitization of user-supplied input provided to the 'mac' argument within the 'del_expmac' function of the '/send_order.cgi' CGI binary.\nThe application acts as an interface between the web-based management console and system-level binaries. When a request is made to '/send_order.cgi?parameter=del_expmac', the backend logic constructs a system command using the value provided in the 'mac' parameter. Because the application fails to adequately filter shell metacharacters (such as ';', '&', '|', '`', or '$()'), an attacker can inject malicious shell commands into the input string.\nThe attack flow begins with an HTTP GET or POST request targeting the vulnerable CGI endpoint. An attacker crafts a payload by appending shell-sensitive characters to the legitimate 'mac' input format. For example, by inputting '00:00:00:00:00:00; [command]', the application may concatenate the user input directly into a system call executed via the underlying shell (e.g., system() or popen()).\nThe web server executes these injected commands with the privileges of the service user, which typically possess high-level access within the embedded Linux environment. This allows for the execution of arbitrary code, which can be utilized for persistent backdoor installation, exfiltration of configuration data, or lateral movement into the local network.\nThe vulnerability is remotely exploitable, requiring no prior authentication. The lack of input validation indicates a failure to implement secure coding practices such as parameterized system calls or strict regex-based allow-listing for hardware addresses. The scope of impact is total device takeover, as the attacker can manipulate the file system, network configuration, or existing security policies enforced by the router. Because the exploit is currently public, the barrier to entry for malicious actors is minimal, requiring only basic knowledge of HTTP request construction to weaponize the vulnerability."
}