CVE-2026-94139: Feiyu Star Router RCE Vulnerability

CVE-2026-94139 Overview

CVE-2026-94139 is a command injection vulnerability [CWE-74] in the Chengdu Feiyuxing Technology Feiyu Star Router firmware version B-MB5E202-210322-r11656. The flaw resides in an unknown function within /send_order.cgi?parameter=loginout, part of the router's Cookie Handler component. Attackers can manipulate the session_id argument to inject arbitrary operating system commands. Exploitation is possible remotely over the network and requires low privileges. Public exploit code is available, increasing the risk of opportunistic attacks. The vendor was contacted before disclosure but did not respond.

Critical Impact

Remote authenticated attackers can inject operating system commands through the session_id cookie parameter, achieving code execution on affected routers with public proof-of-concept code available.

Affected Products

• Chengdu Feiyuxing Technology Feiyu Star Router
• Firmware version B-MB5E202-210322-r11656
• Component: Cookie Handler processing /send_order.cgi?parameter=loginout

Discovery Timeline

• 2026-09-21 - CVE-2026-94139 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94139

Vulnerability Analysis

The vulnerability is a command injection flaw [CWE-74] within the router's web management interface. The endpoint /send_order.cgi?parameter=loginout parses cookie data through the Cookie Handler component. The session_id cookie value is passed to a system-level command execution routine without adequate sanitization or input validation. An attacker who supplies a crafted session_id value can break out of the intended parameter context and append arbitrary shell commands. Because CGI handlers on embedded router firmware typically execute with elevated privileges, injected commands run with the same permissions as the web server process, often root.

Root Cause

The root cause is improper neutralization of special elements in the session_id cookie parameter. The Cookie Handler reads attacker-controlled data and passes it into a shell or command interpreter without escaping metacharacters such as ;, |, &, or backticks. This falls under CWE-74, a general injection weakness stemming from missing input validation between the HTTP request layer and the underlying operating system.

Attack Vector

Exploitation requires network access to the router's web management interface and low-level authenticated privileges. An attacker sends an HTTP request to /send_order.cgi?parameter=loginout with a crafted Cookie: header containing a malicious session_id value. The Feishu wiki and VulDB entries reference publicly available exploit material, so unauthenticated scanners can weaponize this quickly. Successful exploitation grants command execution on the router, enabling firmware tampering, traffic interception, and lateral movement into the internal network. Refer to the VulDB CVE-2026-94139 entry and the Feishu wiki resource for technical proof-of-concept details.

Detection Methods for CVE-2026-94139

Indicators of Compromise

• HTTP requests to /send_order.cgi?parameter=loginout containing shell metacharacters (;, |, &, `, $() in the Cookie: session_id= header.
• Unexpected outbound connections originating from the router to attacker-controlled infrastructure.
• New or modified processes spawned by the router's web server (httpd, boa, or vendor CGI handlers).

Detection Strategies

• Deploy network-based signatures on perimeter sensors that flag suspicious session_id cookie values sent to the send_order.cgi endpoint.
• Inspect router syslog and web access logs for anomalous URI parameters combined with malformed cookies.
• Correlate router administrative access with source IP reputation to identify probing from known scanning infrastructure.

Monitoring Recommendations

• Forward router logs to a centralized log platform and alert on repeated failed authentication followed by requests to send_order.cgi.
• Baseline normal management-plane traffic and alert on out-of-hours access or requests from non-administrative subnets.
• Monitor DNS and NetFlow data for beaconing patterns from router management IPs.

How to Mitigate CVE-2026-94139

Immediate Actions Required

• Restrict access to the router's web management interface to trusted administrative subnets only, blocking WAN-side access.
• Rotate all router administrative credentials and revoke any active management sessions.
• Audit router configuration and firmware integrity for signs of tampering or unauthorized changes.

Patch Information

No vendor patch is available. According to the CVE description, the vendor was contacted before disclosure but did not respond. Organizations operating this device should treat it as end-of-support for security purposes and plan replacement with a supported model. Track the VulDB vulnerability record for any future vendor advisory.

Workarounds

• Disable remote (WAN) administration of the router and enforce management access exclusively through a jump host on the LAN.
• Place the router behind an upstream firewall that filters HTTP requests containing shell metacharacters in Cookie headers targeting /send_order.cgi.
• Segment the router from sensitive internal assets to limit blast radius if command execution occurs.
• Replace the affected device with a vendor-supported router that receives active security updates.

# Example: block external access to the router management interface using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP