| Título | Chengdu Feiyuxing Technology Co., Ltd. (成都飞鱼星科技; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS) B-MB3W202-210825-r11775 Command Injection |
|---|
| Descripción | An OS command injection vulnerability exists in the web administration
interface of Feiyuxing VROS-based routers (VW2100 V1.0 / VEC10GP V1.0).
The web admin is implemented as a monolithic CGI binary, `webserver`
(`var/html/webserver`), which a vendor-patched thttpd executes for every
`*.cgi` URL, passing the URL script name (without `.cgi`) to it as
`argv[1]`.
Requests to `POST /send_order.cgi?parameter=add_expmac` are dispatched by
the handler table in `dealwith_order()` (offset `0x4166D8`, table
`dword_51A7D0`, entry `0x85`) to the handler `sub_4DB5D0` (offset
`0x4DB5D0`). The handler parses the JSON request body, extracts the
string field `mac`, and interpolates it into a shell command that is then
executed via `system_operate()` (which uses `popen()` internally):
```c
mac = cJSON_GetObjectItem(root, "mac")->valuestring;
sprintf(cmd, "cat %s|grep %s|wc -l", "/disk/conf/nbmac.cfg", mac);
system_operate(cmd, out); /* sprintf @0x4DB89C, call @0x4DB8C4, popen @0x40DF1C */
```
The `mac` value is used **unescaped**: while the first `%s` is a fixed
path (`/disk/conf/nbmac.cfg`), the second `%s` is fully attacker
controlled. A payload such as `;id> /var/html/fx_cmd_output.txt;#`
terminates the intended pipeline, executes an arbitrary command, and
comments out the trailing `|wc -l`. Because the CGI process runs as
**root**, the injected command executes with root privileges. The output
is written into the web root (`/var/html/`) and can then simply be
fetched over HTTP (`GET /fx_cmd_output.txt` — non-`.cgi` files are served
statically by the patched thttpd).
Authentication and reachability depend on the firmware build:
* On firmware **`B-MB3W202-210825-r11775`** the `/send_order.cgi`
endpoint is protected by a session gate (`main()` → `check_login()`,
cookie `hash_key=..,session_id=..` matched against
`/tmp/httpsess_<session_id>`); unauthenticated requests are redirected
to `login.html`. The handler itself performs no input validation, so
the injection is exploitable after authentication (verified in
emulation with a valid session). CVSS 3.1: 8.8.
* On **earlier firmware builds** the `send_order` endpoint has no session
gate (this was live-verified for the sibling `swifi_exip` issue,
VULN-2, which shares the same `main()` logic path), so the same request
is an **unauthenticated** root RCE. CVSS 3.1: 9.8.
Related handlers in the same family (`swifi_exip`, `swifi_exmac`,
`del_swifimac`, batch setters) contain the same "request data →
shell string → system()/popen()" pattern and are covered by the
companion submissions.
Impact: command execution as root on the router. Consequences include
full device takeover, theft of configuration and administrator
credentials, persistent backdooring, traffic interception, and use of
the device as a network pivot.
Suggested remediation: strictly validate the `mac` argument (and the
sibling `swifi_*` arguments) as well-formed MAC/IP values before use;
never build shell commands from request data — use `execve()` with an
argument vector; audit all `add_expmac`-family handlers. |
|---|
| Fuente | ⚠️ https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py |
|---|
| Usuario | coke (UID 102155) |
|---|
| Sumisión | 2026-10-16 10:17 (hace 24 días) |
|---|
| Moderación | 2026-11-08 21:19 (24 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 433009 [Chengdu Feiyuxing Technology VW2100/VEC10GP 1.0 B-MB3W202-210825-r11775 Web Administration Interface var/html/webserver add_expmac escalada de privilegios] |
|---|
| Puntos | 20 |
|---|