CVE Intelligence
Analysis AI-assisted

CVE-2026-41922: WDR201A WiFi Extender OS Command Injection in wireless.cgi

CVE-2026-41922 is an OS command injection flaw (CWE-78) in the wireless.cgi binary of the WDR201A WiFi Extender, hardware V2.1 with firmware LFMZX28040922V1.02. The record states that an unauthenticated remote attacker could run arbitrary shell commands, and the CNA assigned a CVSS 4.0 score of 9.3. The record lists no affected or fixed versions and the vulnerability is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-41922 describes an OS command injection flaw in the wireless.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02). The record classifies the issue as CWE-78 and states that unsanitized input in the sz11gChannel and PIN POST parameters can reach the operating system shell.

Impact

  • According to the record, an unauthenticated remote attacker could execute arbitrary shell commands on the device.
  • The CVSS 4.0 vector in the record marks confidentiality, integrity and availability impact on the vulnerable system as High, with no impact stated for subsequent systems.
  • Because the product is a network extender, a compromise could affect traffic and other devices on the local network. This is an inference and is not stated in the record.

Affected products and versions

  • The record describes the WDR201A WiFi Extender, hardware V2.1, firmware LFMZX28040922V1.02.
  • The structured affected and fixes fields are empty, so no other affected versions are confirmed.
  • The vendor is not identified in the structured fields of the record.

Exploitation status

  • The record shows the vulnerability is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.06664 with a percentile of 0.93751, as recorded.

Remediation and mitigation

  • The record does not identify a vendor fix. Check the manufacturer for firmware updates for this model and apply any update that addresses this issue once confirmed.
  • Until a fix is confirmed, limit access to the device management interface, disable remote administration where possible, and avoid exposing the device to untrusted networks.
  • Replace or isolate devices that cannot be updated.

Detection guidance

  • Review device logs and administrative web interface access for unexpected requests to wireless configuration functions.
  • Monitor the device for unexpected outbound connections, unfamiliar processes or unauthorized configuration changes.
  • Maintain an inventory of WDR201A devices with their hardware and firmware versions.

Limitations of the available information

  • The record contains no affected version range, fixed version or vendor advisory.
  • The vendor is not confirmed by the structured fields.
  • The CVSS 4.0 score of 9.3 comes from the CNA; the record does not show a separate NVD score.
  • The record's source status is Deferred.
  • Referenced research pages were not used as the basis for the technical claims in this analysis.

Frequently asked questions

What is CVE-2026-41922?

It is an OS command injection flaw (CWE-78) in the wireless.cgi binary of the WDR201A WiFi Extender, which the record says can be abused without authentication.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is there a fixed firmware version?

The record does not list any fixed version. Check the manufacturer for updates and treat the fix status as unknown until confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.