CVE-2026-41924: WDR201A WiFi Extender OS Command Injection via makeRequest.cgi (CWE-78)
CVE-2026-41924 is an OS command injection flaw in the makeRequest.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02). According to the record, it can be triggered without authentication through the set_time and StartSniffer functions, and VulnCheck scores it 9.3 under CVSS 4.0. The record shows no KEV listing, no affected version list and no fix, so remediation depends on the vendor.
Overview
CVE-2026-41924 affects the WDR201A WiFi Extender, hardware revision V2.1 with firmware LFMZX28040922V1.02. The record classifies it as OS command injection (CWE-78) in the makeRequest.cgi binary. The record was published on 2026-05-04 by VulnCheck, and its status is Deferred in the source data.
Impact
According to the record, an unauthenticated remote attacker could run arbitrary shell commands on the device. VulnCheck rates the issue 9.3 under CVSS 4.0, with high impact on confidentiality, integrity and availability. Because the device is a network extender, a compromise could affect traffic and other devices on the local network.
Affected products and versions
- Product: WDR201A WiFi Extender
- Hardware version: V2.1
- Firmware: LFMZX28040922V1.02
The record does not list affected version ranges or fixed versions. The absence of data in the record does not show that other versions are safe.
Exploitation status
The KEV catalog flag in the record is false. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The EPSS probability is 0.03277 with a percentile of 0.88142, which estimates likelihood of exploitation and does not confirm it.
Remediation and mitigation
- Check the vendor and the VulnCheck advisory for an updated firmware or a formal statement about this issue.
- Until a fix is confirmed, restrict access to the device management interface to trusted administrators and networks.
- Do not expose the device administration interface to the internet.
- Segment the extender from sensitive networks and review whether it is still needed.
- If no vendor support or fix is available, plan replacement with a supported product.
Detection guidance
- Review device and network logs for unexpected requests to the management CGI endpoints and for unusual administrative activity.
- Monitor for unexpected outbound connections from the extender, which could indicate command execution.
- Treat unexplained reboots, configuration changes or new processes on the device as potential signs of compromise.
Limitations of the available information
- The record does not name the vendor or manufacturer.
- No affected version range, fixed version or vendor advisory is listed in the record.
- The record gives no independent test results or proof of concept details, and this analysis does not provide them.
- The 31-byte limit is stated in the record but its operational meaning is not further documented in the sources.
- The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the source.
Frequently asked questions
Is CVE-2026-41924 being actively exploited?
The record shows no KEV listing, and no confirmed exploitation in the wild appears in the sources consulted for this analysis.
Which versions are affected?
The record names the WDR201A hardware V2.1 and firmware LFMZX28040922V1.02, but it lists no affected version range, so other versions cannot be ruled in or out from the record.
Is there a fix?
The record lists no fixed version. That does not mean no fix exists, so check the vendor and the VulnCheck advisory.
What should administrators do now?
Restrict management access, keep the device off the internet, segment it from sensitive networks, and monitor for signs of compromise while waiting for vendor guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.