Command Injection in Chengdu Feiyuxing Technology Feiyu Star Router

A critical command injection vulnerability exists within the Cookie Handler component of the Chengdu Feiyuxing Technology Feiyu Star Router (B-MB5E202-210322-r11656). The flaw resides in the processing logic of the '/send_order.cgi?parameter=loginout' endpoint, specifically failing to sanitize the 'session_id' parameter. An unauthenticated remote attacker can exploit this weakness by injecting shell metacharacters into the 'session_id' argument, leading to arbitrary command execution with the privileges of the web service.

Publicly available exploit code has been identified, increasing the risk of active exploitation. Despite attempts to notify the vendor, no security patches or remediations have been issued. The vulnerability is highly relevant for defenders as it allows for trivial remote code execution on edge network devices, potentially facilitating lateral movement, device takeover, or traffic interception within the target environment. Given the lack of a vendor patch, organizations should consider isolating these devices or restricting access to the management interface.

Impact

Successful exploitation grants an attacker full remote code execution on the router, which typically acts as a gateway for the network. This provides an entry point for further compromise of internal systems, traffic monitoring, or persistent backdoor installation within the network infrastructure.

Recommendation

Prioritized actions for security teams:

• Isolate affected Feiyu Star Router units from the public internet immediately to prevent unauthenticated access to '/send_order.cgi'.
• Implement ingress filtering on the perimeter firewall to restrict access to the web management interface of these devices to known, trusted administrative IP addresses.
• Monitor logs for HTTP requests directed at '/send_order.cgi?parameter=loginout' containing shell-sensitive characters (e.g., ;, |, &, $, `) in the session_id parameter.
• Since the vendor has not provided a patch for CVE-2026-94139, evaluate replacement options if the device cannot be adequately secured through network segmentation.