Submeter #1038438: Chengdu Feiyuxing Technology Co., Ltd. (成都飞鱼星科技; adslr.com) VW2100 V1.0 / VEC10GP V1.0 (VROS) B-MB3W202-210825-r11775 and earlier builds Command Injection

An OS command injection vulnerability exists in the web administration
interface of Feiyuxing VROS-based routers (VW2100 V1.0 / VEC10GP V1.0).
The web admin is implemented as a monolithic CGI binary, `webserver`
(`var/html/webserver`), which is executed for every `*.cgi` URL by a
vendor-patched thttpd; the URL script name (without `.cgi`) is passed to
the binary as `argv[1]` and selects the request handler.

The `weixin_auth` entry (`POST /weixin_auth.cgi`) is explicitly
whitelisted in the authentication logic of `main()` (around offset
`0x4044C8`) as a "skip session check" endpoint: for this `argv[1]` value
the session validation (`check_login()`) is bypassed entirely, so the
endpoint is reachable **without any cookie, session or login**.

The handler `handle_wechat_cn_wifi()` (offset `0x4D2B70`) reads the HTTP
parameter `extend` (from the POST body or the query string). If the
parameter starts with the 20-byte marker `volanswechatconnwifi` (a WeChat
Wi-Fi onboarding token), the handler copies 17 bytes at offset 20..36 of
the parameter into a local stack buffer — the field is intended to carry
a MAC address — and interpolates that buffer into a shell command:

```c
snprintf(cmd, 512,
"echo 'weixin_authed %s %d' > /proc/weixin_config &",
buf, inet_addr(getenv("REMOTE_ADDR")));
system(cmd); /* offset 0x4D2DF8 */
```

The attacker-controlled 17 bytes are placed **inside single quotes** and
are not escaped or validated in any way. A single quote breaks out of
the quoted string, a semicolon terminates the `echo` command, and `#`
comments out the remainder of the command line. For example,
`extend=volanswechatconnwifi';id;#` results in the shell executing `id`
on the device in addition to the intended echo. Because the CGI process
runs as **root**, the injected command executes with root privileges.

Exploitation constraints: the injection window is 17 bytes, i.e. the
payload form `';CMD;#'` allows commands of up to 13 characters per
request. Larger command output can be staged to a file and read back
with a second request (`';id>/tmp/p;#'` followed by `';cat</tmp/p;#'`).

The issue was verified against firmware `B-MB3W202-210825-r11775` by
executing the unmodified firmware rootfs (its own thttpd and `webserver`
CGI binary) under `qemu-mipsel` user-mode emulation: a single request
without any authentication returned `uid=0(root) gid=0(root)` in the
HTTP response body, and file-marker evidence confirmed root-level
execution.

Impact: remote **unauthenticated** command execution as root — full
device compromise, theft of configuration and administrator credentials,
persistent backdooring, traffic interception, and use as a network
pivot. The product supports external (WAN-side) web administration and
internet-facing instances were observed, so the vulnerability can be
exploited at scale.

Suggested remediation: validate the `extend` parameter as a MAC address
before use; never build shell command strings from request data, use
`execve()` with an argument vector instead; do not rely on the session
layer to protect this endpoint.

• Fonte: ⚠️ https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py
• Utilizador: Walnut1337 (UID 100856)
• Submissão: 16/10/2026 04h53 (há 24 dias)
• Moderação: 08/11/2026 18h10 (24 days later)
• Estado: Aceite
• Entrada VulDB: 432937 [Chengdu Feiyuxing Technology VW2100/VEC10GP 1.0 B-MB3W202-210825-r11775 Weixin Auth Endpoint var/html/webserver handle_wechat_cn_wifi extend Elevação de Privilégios]
• Pontos: 20