CVE Intelligence
Analysis AI-assisted

CVE-2026-41925: WDR201A WiFi Extender OS Command Injection via adm.cgi

CVE-2026-41925 describes an OS command injection flaw (CWE-78) in the adm.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02), reachable without authentication. The CNA assigned a CVSS 4.0 base score of 9.3, but the record lists no affected or fixed versions, and the CISA KEV catalog does not list it. Operators should restrict access to the device's administration interface and check for vendor updates.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection flaw (CWE-78) in the adm.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02), in its reboot_time function. The VulnCheck advisory states that unauthenticated remote attackers can trigger it.

Impact

  • A successful attack could allow an unauthenticated remote attacker to run arbitrary shell commands on the device, which the record describes as remote code execution.
  • The CVSS 4.0 vector supplied by the CNA rates confidentiality, integrity and availability impact as High, with no privileges or user interaction required.
  • The base score recorded is 9.3 (CVSS 4.0, provided by disclosure@vulncheck.com).

Affected products and versions

  • The record names the WDR201A WiFi Extender, hardware V2.1, firmware LFMZX28040922V1.02.
  • The affected and fixes lists in the record are empty. Whether other firmware versions are affected, and which version fixes the issue, is unknown from the available data.

Exploitation status

  • The record shows the CISA KEV listing as false. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability recorded is 0.04098 with a percentile of 0.90527. This is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Confirm whether your deployed devices match the hardware and firmware listed, and inventory them.
  • Check the vendor and CNA channels for a firmware update. The record does not identify one.
  • Until a fix is confirmed, limit access to the web administration interface to trusted networks, disable remote administration where the device allows it, and plan to isolate or replace devices that cannot be updated.
  • Do not expose the device's administration interface to the internet.

Detection guidance

  • Review device and web server logs for unexpected requests to the administration CGI, especially from unknown sources.
  • Watch for unexpected reboots, configuration changes or outbound connections from the extender.

Limitations of the available information

  • The record does not name the vendor and no vendor advisory was available in the sources consulted.
  • No fixed version, patch status or score from other providers is recorded. The only CVSS score comes from a single CNA.
  • The referenced third-party research post was not analysed for this summary; the mechanism details rely on the record's description.

Frequently asked questions

What is CVE-2026-41925?

It is an OS command injection vulnerability (CWE-78) in the adm.cgi binary of the WDR201A WiFi Extender, affecting hardware V2.1 and firmware LFMZX28040922V1.02, according to the record.

Does it require authentication?

The VulnCheck advisory referenced in the record states that unauthenticated remote attackers can trigger the flaw.

Is it known to be exploited?

The record shows the CISA KEV listing as false, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.