A command injection vulnerability in the Chengdu Feiyuxing Feiyu Star Router allows authenticated remote attackers to execute arbitrary system commands, posing a significant risk of unauthorized access.

This vulnerability is a command injection flaw (CWE-77) located in the Cookie Handler component. An authenticated attacker can manipulate the session_id parameter within the /send_order.cgi endpoint to trigger unauthorized command execution on the underlying operating system.

The ability to execute arbitrary commands on a network router enables an attacker to gain full control over internal network traffic, intercept sensitive data, or establish a persistent foothold within the infrastructure. With a CVSS score of 7.4, this high-severity vulnerability represents a substantial threat to network integrity and confidentiality.

Immediate Action: Since no official patch is currently available from the vendor, restrict management access to the device to trusted internal segments only and disable remote administrative access.

Proactive Monitoring: Monitor device logs for unusual spikes in traffic or suspicious patterns directed at the /send_order.cgi endpoint, particularly those containing shell metacharacters in the session_id field.

Compensating Controls: Implement a Web Application Firewall or network-based intrusion prevention system to filter and block malicious requests targeting the vulnerable CGI script.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided in the vulnerability references.

Given the presence of a public exploit and the lack of a vendor-supplied patch, this vulnerability must be treated with high priority. Organizations using the affected Feiyu Star Router firmware should isolate the device from external exposure immediately and maintain strict monitoring of all administrative interfaces until a formal update is released.