CVE-2026-2548: WAYOS FBM-220G RCE Vulnerability

CVE-2026-2548 Overview

A command injection vulnerability has been discovered in WAYOS FBM-220G firmware version 24.10.19. This flaw affects the function sub_40F820 within the rc file, where improper handling of the upnp_waniface, upnp_ssdp_interval, and upnp_max_age arguments allows attackers to inject and execute arbitrary commands. The vulnerability can be exploited remotely over the network by authenticated attackers, potentially leading to complete device compromise.

Critical Impact
Remote command injection in IoT router firmware can allow attackers to execute arbitrary system commands, potentially leading to device takeover, network pivoting, data exfiltration, and use of the compromised device in botnet operations.

Affected Products

WAYOS FBM-220G firmware version 24.10.19

Discovery Timeline

February 16, 2026 - CVE-2026-2548 published to NVD
February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2548

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection. The affected function sub_40F820 in the rc binary fails to properly sanitize user-supplied input for the UPnP configuration parameters before passing them to system command execution routines.

The vulnerable parameters include upnp_waniface (the WAN interface setting), upnp_ssdp_interval (SSDP advertisement interval), and upnp_max_age (UPnP advertisement max-age value). When an authenticated attacker manipulates these parameters with specially crafted input containing shell metacharacters or command separators, the injected commands are executed in the context of the router's operating system.

The network attack vector combined with low authentication requirements means that any authenticated user with access to the device's configuration interface could potentially exploit this vulnerability. The vendor was contacted regarding this disclosure but did not respond.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the sub_40F820 function. The function directly incorporates user-controlled input from UPnP configuration parameters into command execution contexts without properly escaping or filtering special characters. This allows command injection through shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax.

Attack Vector

The attack can be executed remotely over the network. An attacker with low-privilege authentication to the device can access the UPnP configuration settings and inject malicious commands through the vulnerable parameters. The manipulation of upnp_waniface, upnp_ssdp_interval, or upnp_max_age fields with command injection payloads results in arbitrary command execution on the underlying operating system.

For detailed technical information regarding this vulnerability, refer to the GitHub IoT Vulnerability Document and VulDB entry #346157.

Detection Methods for CVE-2026-2548

Indicators of Compromise

Unusual HTTP requests to UPnP configuration endpoints containing shell metacharacters (;, |, &&, backticks, $())
Unexpected outbound network connections from the WAYOS FBM-220G device
Modified configuration files or unexpected processes running on the router
Log entries showing malformed UPnP parameter values or command execution errors

Detection Strategies

Monitor network traffic to and from WAYOS FBM-220G devices for suspicious configuration changes
Implement web application firewall rules to detect command injection patterns in HTTP requests targeting router management interfaces
Deploy network-based intrusion detection signatures for common command injection payloads in UPnP-related traffic
Review device logs for anomalous authentication events followed by configuration changes

Monitoring Recommendations

Enable verbose logging on network management interfaces if available
Set up alerts for configuration changes to UPnP settings on affected devices
Monitor for unusual process execution or network behavior originating from IoT devices
Regularly audit firmware versions across all WAYOS devices in the network

How to Mitigate CVE-2026-2548

Immediate Actions Required

Restrict network access to the WAYOS FBM-220G management interface to trusted IP addresses only
Disable UPnP functionality if not required for business operations
Place affected devices behind a firewall with strict ingress filtering
Implement network segmentation to isolate IoT devices from critical network resources

Patch Information

At the time of publication, the vendor (WAYOS) has not responded to disclosure attempts and no official patch is available. Organizations should implement the recommended workarounds and monitor for vendor security advisories. Additional technical details are available through VulDB CTI ID #346157.

Workarounds

Disable remote management access to the device and only allow local administration
Implement strict firewall rules to block external access to the router's management ports
Use VPN or other secure channels for any necessary remote administration
Consider replacing affected devices with alternatives from vendors with active security response programs

bash

# Example firewall rule to restrict management access (adapt to your environment)
# Block external access to common router management ports
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 8080 -s ! 192.168.1.0/24 -j DROP