PT-2026-8322 · Unknown · Wayos Fbm-220G

Jfkk · Published 2026-02-16 · Updated 2026-02-18 · CVE-2026-2548

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WAYOS FBM-220G version 24.10.19

Description A flaw exists in WAYOS FBM-220G version 24.10.19 related to command injection. Manipulation of the arguments upnp waniface, upnp ssdp interval, and upnp max age within the sub 40F820 function of the rc file can allow for remote execution of commands. The vendor was contacted regarding this issue but did not provide a response.

Recommendations As a temporary workaround, consider restricting or disabling the use of the upnp waniface, upnp ssdp interval, and upnp max age arguments. Disable the sub 40F820 function if possible. Avoid using the rc file if it is not essential for the operation of the system.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-2548

Affected Products

Wayos Fbm-220G

References · 8

• 🔥 https://github.com/glkfc/IoT-Vulnerability/blob/main/wayos/wayos.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2548 · Security Note
• https://vuldb.com/?ctiid.346157 · Note
• https://vuldb.com/?id.346157 · Note
• https://t.me/cveNotify/152100 · Telegram Post
• https://vuldb.com/?submit.749802 · Note
• https://t.me/CVEtracker/44801 · Telegram Post
• https://twitter.com/SecAideInfo/status/2024070975428637033 · Twitter Post