Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-94138: Feiyu Star Router allows remote command injection

CVE-2026-94138 · published 28 days ago

Summary

The Feiyu Star Router can be tricked into running unauthorized commands when a specially crafted request is sent to its web interface. This means an attacker on the network could potentially take control of the device. Apply the latest firmware update or restrict access to the router's management pages to mitigate the risk.

Original advisory text

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

2% chance of attack within 30 days

Type

CWE-74Injection

CWE-77Command Injection

Timeline

Published21 Sep 2026

Updated15 Oct 2026

First seen21 Sep 2026

Sources

CVE-2026-94138 · NVD

Track software like this

Free during beta