{"metadata": {"vulnerability": "CVE-2026-124580", "count": 21, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-08T00:00:00Z", "date_only": false, "value": "2026-11-08T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124580", "field": "containers.cna.timeline.0.time", "text": "Advisory disclosed"}, {"timestamp": "2026-11-08T01:00:00Z", "date_only": false, "value": "2026-11-08T01:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124580", "field": "containers.cna.timeline.1.time", "text": "VulDB entry created"}, {"timestamp": "2026-11-08T17:10:33.059Z", "date_only": false, "value": "2026-11-08T17:10:33.059Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T18:15:55Z", "date_only": false, "value": "2026-11-08T18:15:55.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124580", "field": "containers.cna.timeline.2.time", "text": "VulDB entry last update"}, {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124580", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T08:05:21.733Z", "date_only": false, "value": "2026-11-09T08:05:21.733699Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117585446252542270", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "d4583af7-726c-453a-a48d-5c4d17d44cca", "content": "CVE-2026-124580 Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124580https://vuldb.com/vuln/432937https://vuldb.com/vuln/432937/ctihttps://vuldb.com/cve/CVE-2026-124580https://vuldb.com/submit/1038438https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.mdhttps://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py#ChengduFeiyuxingTechnology #VW2100 #VEC10GP#CVE_2026_124580#bot", "url": "https://infosec.exchange/users/cve/statuses/117585446252542270"}, {"timestamp": "2026-11-09T08:17:02Z", "date_only": false, "value": "2026-11-09T08:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4FRQ-3C52-PFC8", "record": "GHSA-4FRQ-3C52-PFC8", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T08:17:02.923Z", "date_only": false, "value": "2026-11-09T08:17:02.923", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124580", "record": "FKIE_CVE-2026-124580", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T08:17:03.070Z", "date_only": false, "value": "2026-11-09T08:17:03.070", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124580", "record": "FKIE_CVE-2026-124580", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T08:31:12.412Z", "date_only": false, "value": "2026-11-09T08:31:12.412111Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzuj6f52j7rw", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "a0044025-5482-4586-931d-4bd515923344", "content": "CVE Radar | CVE-2026-124580 | CVSS 10.0\n\nFeiyuxing Weixin Auth Command Injection\n\nCVE-2026-124580 affects Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1397", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzuj6f52j7rw"}, {"timestamp": "2026-11-09T08:31:16.722Z", "date_only": false, "value": "2026-11-09T08:31:16.722080Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzuj6jy22v2k", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "03d4b90b-8fd0-4312-aec8-3fdbf6281b3e", "content": "\ud83d\udd34 CVE-2026-124580 - Critical (10)\n\nA vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-124580/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzuj6jy22v2k"}, {"timestamp": "2026-11-09T08:50:03.133Z", "date_only": false, "value": "2026-11-09T08:50:03.133738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzuka4s3mo2q", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "8897de14-ab47-4332-8795-2a4cde81a6b8", "content": "CVE-2026-124580 - vw2100\nThe web server used by the Weixin authentication feature on VW2100 and VEC10GP devices can be tricked into running operating\u2011system commands when an attacker changes the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vw2100 #chengdufeiyuxing #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzuka4s3mo2q"}, {"timestamp": "2026-11-09T09:00:36.827Z", "date_only": false, "value": "2026-11-09T09:00:36.827515Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117585663499489154", "record": "cve-2026-124580", "field": "creation_timestamp", "uuid": "cbcc7dc1-b4a6-4276-b84d-96cfbb108df4", "content": "CRITICAL OS command injection (CVE-2026-124580) in Chengdu Feiyuxing VW2100 & VEC10GP: remote, unauthenticated attackers can run OS commands. Exploit is public, no fix available. Isolate or filter at network level. https://radar.offseq.com/threat/cve-2026-124580-os-command-injection-in-chengdu-feiyuxing-technology-vw2100-068caf8e4a2c88ff #OffSeq #infosec #vulnerability #CVE2026_124580", "url": "https://infosec.exchange/users/offseq/statuses/117585663499489154"}, {"timestamp": "2026-11-09T09:00:38.502Z", "date_only": false, "value": "2026-11-09T09:00:38.502755Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mzukt2m2cp2i", "record": "cve-2026-124580", "field": "creation_timestamp", "uuid": "44b597b4-9c59-47ab-8920-b6bf429db39e", "content": "CVE-2026-124580: CRITICAL command injection in Chengdu Feiyuxing VW2100 allows remote, unauthenticated RCE. Public exploit, no patch. Isolate or filter affected devices ASAP. https://radar.offseq.com/threat/cve-2026-124580-os-command-injection-in-chengdu-feiyuxing-technology-vw2100-068caf8e4a2c88...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mzukt2m2cp2i"}, {"timestamp": "2026-11-09T09:20:04.558Z", "date_only": false, "value": "2026-11-09T09:20:04.558383Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3tploiuzfpsmb", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "09385e5a-864a-4535-9606-6e492c92c884", "content": "CVE-2026-124580 - Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection\nCVE ID : CVE-2026-124580\n \n Published : Nov. 9, 2026, 8:17 a.m. | 57\u00a0minutes ago\n \n Description : A vulnerability was found in Chengdu Feiyux...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3tploiuzfpsmb"}, {"timestamp": "2026-11-09T09:31:44Z", "date_only": false, "value": "2026-11-09T09:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4FRQ-3C52-PFC8", "record": "GHSA-4FRQ-3C52-PFC8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T09:31:44Z", "date_only": false, "value": "2026-11-09T09:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4FRQ-3C52-PFC8", "record": "GHSA-4FRQ-3C52-PFC8", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T10:07:13.676Z", "date_only": false, "value": "2026-11-09T10:07:13.676845Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzuok4xtqu2o", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "e7939192-33d0-49ca-a572-de06b6f13a71", "content": "\ud83d\udea8 CVE-2026-124580 \u2014 CVSS 9.3 CRITICAL\n\nA vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. T...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-124580\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzuok4xtqu2o"}, {"timestamp": "2026-11-09T12:40:31.505Z", "date_only": false, "value": "2026-11-09T12:40:31.505059Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzux4amv3g2q", "record": "CVE-2026-124580", "field": "creation_timestamp", "uuid": "5dd67984-64b9-47e8-a453-6de4c076333b", "content": "Patch watch: CVE-2026-124580 (Chengdu Feiyuxing Technology VW2100, CVSS 9.3). A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. No public exploit reported yet. #CVE #infosec\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzux4amv3g2q"}], "metrics": {"as_of": "2026-11-10T15:43:01.696Z", "anchors": {"origin": {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 114157.48669, "hours": 31.710412969444445, "days": 1.3212672070601852, "min_seconds": 114157.48669, "max_seconds": 114157.48669, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T08:00:24.210Z", "date_only": false, "value": "2026-11-09T08:00:24.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124580", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T15:43:01.696Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}