CVE-2026-94138 in Feiyu Star Router
Summary
by MITRE • 09/21/2026
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
A critical remote code execution vulnerability has been identified within the Chengdu Feiyuxing Technology Feiyu Star Router, specifically affecting firmware version B-MB5E202-210322-r11656 and potentially other variants of this hardware line. The flaw resides in the web management interface component responsible for handling network configuration updates, particularly within the script located at /send_order.cgi?parameter=del_expmac. This specific endpoint is designed to process requests related to deleting or managing extended MAC address entries, a feature commonly used in enterprise networking environments to enforce access control policies based on device hardware identifiers. The vulnerability arises from an insufficient validation and sanitization of user-supplied input within the mac parameter passed to this CGI script.
The technical nature of this flaw is classified as command injection, which falls under CWE-78: Improper Neutralization of Special Elements used in an Operating System Command. When a remote attacker submits a crafted HTTP request containing shell metacharacters or commands embedded within the mac address field, the backend processing logic fails to properly escape these special elements before passing them to system-level command interpreters such as sh or bash. This lack of input sanitization allows the injected payload to be executed with the privileges of the web server process, which on many IoT and router devices often runs with root or equivalent administrative rights. Consequently, an attacker can achieve arbitrary code execution on the target device without requiring any form of authentication, leveraging the unauthenticated nature of this specific management interface function.
The operational impact of this vulnerability is severe due to its remote exploitability over standard network protocols such as HTTP and HTTPS. Since no prior authentication is required to trigger the flaw, an attacker located anywhere with network connectivity to the router can compromise the device. Successful exploitation grants full control over the router's operating system, allowing for a wide range of malicious activities including but not limited to installing persistent backdoors, pivoting into internal networks by manipulating routing tables or firewall rules, intercepting and modifying unencrypted traffic through man-in-the-middle attacks, and using the compromised device as part of a botnet. The fact that public exploits have already been released significantly lowers the barrier for entry, enabling less sophisticated threat actors to launch automated campaigns against vulnerable devices at scale.
This incident highlights significant deficiencies in secure software development lifecycle practices within the vendor's engineering process. The absence of input validation mechanisms such as allow-listing expected MAC address formats or using parameterized commands instead of string concatenation demonstrates a fundamental misunderstanding of web application security principles. Furthermore, the lack of response from Chengdu Feiyuxing Technology following early notification suggests inadequate vulnerability management and disclosure policies, leaving users exposed to known risks without access to official patches or guidance. This behavior is consistent with CWE-250: Execution with Unnecessary Privileges if the service runs as root unnecessarily, and CWE-732: Incorrect Permission Assignment for Critical Resource if sensitive configuration files are accessible via this injection vector.
Mitigation strategies must be implemented immediately given the high severity of the flaw and the availability of public exploits. Network administrators should prioritize isolating affected routers from untrusted networks by restricting access to the management interface through firewall rules that limit source IP addresses to trusted administrative subnets only. If remote management is not strictly required, it should be disabled entirely via physical reset or alternative configuration methods if available. Users are strongly advised to check for firmware updates from the vendor immediately upon any future response, although given the lack of communication history, reliance on official patches may be limited. In the interim, deploying intrusion detection systems with signatures capable of detecting command injection payloads in HTTP requests can provide a layer of defense against automated exploitation attempts. Additionally, changing default credentials and disabling unnecessary services such as UPnP or Telnet reduces the overall attack surface while waiting for potential vendor remediation efforts to materialize.