This vulnerability involves command injection in the Feiyu Star Router B-MB5E202-210322-r11656 model. The flaw exists in the /send_order.cgi endpoint's del_expmac parameter, where improper handling of the mac argument allows remote command execution. The vendor has not issued any response or patch, and a public exploit has been released. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and partial impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected router, potentially compromising device integrity and availability. The medium CVSS score reflects partial impact on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported yet.

No official patch or remediation has been provided by the vendor. Users should consider isolating the affected device from untrusted networks and monitor for suspicious activity. Due to the lack of vendor response, alternative mitigations such as disabling the vulnerable endpoint or replacing the device should be considered.