Threats tagged 'ghsa-4frq-3c52-pfc8'

A critical remote code execution vulnerability exists in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. The flaw is in the handle_wechat_cn_wifi function of the Weixin Auth Endpoint component, where improper handling of the 'extend' argument allows OS command injection. Exploit code has been publicly disclosed, but the vendor has not responded or issued a patch.