CVE-2026-94138 Overview
CVE-2026-94138 is a command injection vulnerability in the Chengdu Feiyuxing Technology Feiyu Star Router, firmware version B-MB5E202-210322-r11656. The flaw resides in the /send_order.cgi endpoint when invoked with the parameter=del_expmac argument. Attackers can manipulate the mac parameter to inject arbitrary operating system commands. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can inject operating system commands through the mac parameter of /send_order.cgi?parameter=del_expmac, gaining execution on the router.
Affected Products
- Chengdu Feiyuxing Technology Feiyu Star Router
- Firmware version B-MB5E202-210322-r11656
- /send_order.cgi command handler (del_expmac action)
Discovery Timeline
- 2026-09-21 - CVE-2026-94138 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-94138
Vulnerability Analysis
The vulnerability affects the /send_order.cgi script exposed by the router's web management interface. When the endpoint receives a request with parameter=del_expmac, it processes the mac argument without proper neutralization of shell metacharacters. An attacker who supplies crafted input with command separators such as ;, |, or backticks can break out of the intended argument context and execute arbitrary commands in the router's underlying operating system. The attack is remote and requires high privileges, meaning the attacker must be authenticated to the device management interface before triggering the injection.
Root Cause
The root cause is improper input neutralization ([CWE-74]) in the handler for the del_expmac operation. User-controlled data from the mac HTTP parameter is passed to a system-level command execution primitive without sanitization or safe API usage. The absence of allow-listing or parameterized execution allows shell interpreters to treat injected metacharacters as command boundaries.
Attack Vector
Exploitation requires network access to the router's management interface and valid administrative credentials. The attacker sends an HTTP request to /send_order.cgi?parameter=del_expmac with a crafted mac value containing shell metacharacters and appended commands. Because the endpoint performs no sanitization, injected commands execute in the context of the CGI process, typically with elevated privileges on embedded router firmware. Public proof-of-concept material is referenced through VulDB Vulnerability Details.
No verified exploitation code is republished here. Refer to the Feishu Document and VulDB CVE-2026-94138 for technical write-ups.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-94138
Indicators of Compromise
- HTTP requests to /send_order.cgi containing parameter=del_expmac and non-MAC-format values in the mac argument.
- Presence of shell metacharacters such as ;, |, &, $(, or backticks inside the mac parameter value.
- Unexpected child processes spawned by the router's CGI handler or web server process.
Detection Strategies
- Deploy web application firewall or intrusion detection signatures that validate the mac parameter matches a strict MAC address regular expression (for example, ^[0-9A-Fa-f:.-]{12,17}$).
- Correlate administrative authentication events with subsequent send_order.cgi requests to identify session abuse.
- Inspect router syslog output for anomalous command execution paths adjacent to CGI request timestamps.
Monitoring Recommendations
- Forward router HTTP access logs and syslog to a centralized logging platform for query and retention.
- Alert on outbound connections initiated by the router to unexpected destinations, which may indicate post-exploitation activity.
- Track configuration and firmware integrity to detect tampering after suspected exploitation.
How to Mitigate CVE-2026-94138
Immediate Actions Required
- Restrict access to the router's management interface to trusted management VLANs or specific administrative IP addresses.
- Rotate all administrative credentials on affected devices and enforce strong, unique passwords.
- Disable remote WAN-side management if it is currently enabled on the device.
- Monitor the VulDB CVE-2026-94138 entry for updates and vendor responses.
Patch Information
No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Organizations operating the affected Feiyu Star Router firmware B-MB5E202-210322-r11656 should treat the device as unpatched and consider replacement with a supported product if operational needs allow.
Workarounds
- Place the router behind a network segmentation boundary that blocks untrusted access to TCP ports serving the management interface.
- Require VPN authentication before allowing any access to router administration endpoints.
- If the del_expmac function is not required, block requests to /send_order.cgi?parameter=del_expmac at an upstream reverse proxy or firewall.
- Audit and remove unused administrative accounts to reduce the population of credentials that could satisfy the high-privilege precondition.
# Example upstream filter (iptables) restricting router management access
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
