CVE-2026-94139 in Feiyu Star Router
Summary
by MITRE • 09/21/2026
A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_order.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument session_id causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability resides within the Chengdu Feiyuxing Technology Feiyu Star Router, specifically affecting firmware version B-MB5E202-210322-r11656 and earlier iterations of this hardware line. The core issue is located in the Cookie Handler component, which processes HTTP requests directed at the /send_order.cgi endpoint with a parameter named loginout. This specific function handles session management for user authentication states within the router's web interface. A critical flaw exists in how the application parses and validates input provided via the session_id argument associated with this cookie handler mechanism. The lack of proper sanitization or validation allows an attacker to inject arbitrary operating system commands directly into the underlying shell environment that processes these requests. This represents a classic command injection vulnerability, where user-controllable data is passed unsafely to a system interpreter without adequate checks for malicious content.
From a technical perspective, this flaw aligns with Common Weakness Enumeration identifier CWE-78, which describes improper neutralization of special elements used in an OS command. The attacker can manipulate the session_id value to include shell metacharacters such as semicolons or pipes, thereby chaining additional commands after the legitimate execution flow initiated by the router's firmware. Because this functionality is exposed through a web interface accessible over the network, the vulnerability supports remote exploitation without requiring prior authentication in many configurations, although some routers may require an active session depending on specific implementation details of the loginout logic. The fact that public exploits are already available significantly lowers the barrier to entry for attackers, enabling automated scanning tools and opportunistic adversaries to compromise affected devices with minimal effort.
The operational impact of this vulnerability is severe, as it grants a remote attacker full control over the underlying operating system running on the router. This level of access allows for complete device takeover, including reading sensitive configuration files, modifying network settings, installing persistent backdoors, or using the compromised router as a pivot point to attack other devices within the local network segment. Given that routers often serve as gateways between internal private networks and the public internet, compromising one such device can lead to widespread lateral movement and data exfiltration across an entire infrastructure. The lack of vendor response further exacerbates the risk, leaving users with no official patches or firmware updates to mitigate this critical security flaw through standard update channels.
To address these risks, immediate mitigation strategies must be employed by administrators since a patch is unavailable from Chengdu Feiyuxing Technology. Network segmentation should be utilized to isolate router management interfaces from general user traffic wherever possible. If the web interface does not require external access, it should be disabled entirely or restricted via firewall rules to allow connections only from trusted internal IP addresses. Additionally, implementing strict input validation at any intermediate proxy or gateway before requests reach the device can provide a layer of defense against command injection attempts. Users are strongly advised to monitor for vendor announcements regarding potential firmware updates and consider replacing affected hardware with models that receive active security support if long-term stability is required. This situation highlights the importance of supply chain security and the risks associated with maintaining devices from vendors who do not prioritize timely vulnerability disclosure and remediation practices aligned with industry standards such as those outlined in MITRE ATT&CK techniques for initial access and execution via web services.