CVE Intelligence
Analysis AI-assisted

CVE-2026-41923: WDR201A WiFi Extender OS Command Injection

CVE-2026-41923 affects the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) and is an OS command injection flaw (CWE-78) in the internet.cgi binary that the record says is reachable without authentication. VulnCheck assigns a CVSS 4.0 score of 9.3, and the record labels the severity critical. The sources consulted show no fixed version and no KEV listing, so affected devices should be treated as exposed until the vendor publishes guidance.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-41923 is recorded against the WDR201A WiFi Extender, hardware V2.1 with firmware LFMZX28040922V1.02. The weakness is classified as OS command injection (CWE-78). VulnCheck published an advisory, and the record was published on 2026-05-04 with source status Deferred.

Impact

  • According to the record, an unauthenticated remote attacker could run arbitrary shell commands on the device.
  • The CVSS 4.0 vector reported by VulnCheck indicates high impact to confidentiality, integrity and availability of the vulnerable system, with no impact on subsequent systems.
  • The description states that partial command output is reflected in HTTP responses.

Affected products and versions

  • Product: WDR201A WiFi Extender, HW V2.1, FW LFMZX28040922V1.02, as stated in the record.
  • The affected and fixes fields of the record are empty, so no other versions or fixed builds are confirmed.
  • Whether other hardware revisions or firmware builds are affected is unknown.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.03166 with a percentile of 0.87688, recorded for 2026-10-13. EPSS estimates likelihood of exploitation; it is not evidence that exploitation has occurred.

Remediation and mitigation

  • Inventory WDR201A devices and confirm whether they run the listed hardware and firmware combination.
  • Check the VulnCheck advisory and the vendor for firmware updates, since no fixed version is listed in the record.
  • Do not expose the management interface to the internet, and restrict access to trusted administrative networks.
  • Disable remote administration features if the device offers them.
  • If no fix becomes available, plan to isolate or replace the device.

Detection guidance

  • Review logs from upstream gateways and firewalls for unusual POST requests directed at the device's web interface.
  • Monitor the device for unexpected outbound connections, configuration changes or reboots.
  • Treat any unexplained behavior from an exposed extender as a potential compromise and investigate it.

Limitations of the available information

  • The record has no title, and its affected and fixes lists are empty.
  • The only CVSS score in the record is the 4.0 score from VulnCheck; no other provider scores are present.
  • The NVD entry and the CVE Record are cited as record sources, but no vendor statement was available among the sources consulted.
  • The record includes a supplier marketplace page, which was not used as technical evidence.

Frequently asked questions

Is CVE-2026-41923 known to be exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Is there a fixed firmware version?

The record lists no fixed version. Check the vendor and the VulnCheck advisory for updates.

How severe is this vulnerability?

VulnCheck assigns a CVSS 4.0 score of 9.3, and the record labels the severity critical.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.