Vulnerability · Published Feb 16, 2026 · Assigned by VulDB
CVE-2026-2548WAYOS FBM-220G rc sub_40F820 command injection
Medium 6.3
In plain English
A medium-severity command injection in FBM-220G from WAYOS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)2.2%top 17.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub_40F820 of the file rc. Executing a manipulation of the argument upnp_waniface/upnp_ssdp_interval/upnp_max_age can lead to command injection. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-346157 | WAYOS FBM-220G rc sub_40F820 command injection vdb-entry, technical-description
- VDB-346157 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #749802 | WAYOS FBM220G and others 24.10.19 Command Injection third-party-advisory
- https://github.com/glkfc/IoT-Vulnerability/blob/main/wayos/wayos.md related