CVE Intelligence
Analysis AI-assisted

CVE-2026-41926: WDR201A WiFi Extender: OS Command Injection via firewall.cgi

The WDR201A WiFi Extender contains an OS command injection flaw in its firewall.cgi binary, classified as CWE-78 and scored 9.3 under CVSS 4.0 by the CNA. The record states that injected payloads persist in NVRAM and run again on later firewall.cgi requests. The record lists no fixed version and no CISA KEV entry.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The WDR201A WiFi Extender (hardware V2.1, firmware LFMZX28040922V1.02) is affected by an OS command injection flaw (CWE-78) in the firewall.cgi binary. According to the record, five request handlers apply insufficient input validation, which allows crafted values to reach the operating system shell.

Impact

  • The record describes arbitrary shell command execution by a remote attacker. The CVSS 4.0 vector indicates network access, low complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable system.
  • The record states that injected payloads persist in NVRAM and run again on every later firewall.cgi request, which may prolong a compromise after a single malicious request.
  • The CNA VulnCheck reports a base score of 9.3 (critical) under CVSS 4.0.

Affected products and versions

  • Product: WDR201A WiFi Extender.
  • Hardware: V2.1.
  • Firmware: LFMZX28040922V1.02.
  • The structured affected list in the record is empty, so other hardware revisions or firmware builds cannot be confirmed from the sources consulted.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. The record includes an EPSS probability of about 1.9% and a percentile of about 79%, which estimates the likelihood of exploitation but is not evidence that exploitation has occurred.

Remediation and mitigation

  • The record contains no fixed version or vendor patch. Contact the device vendor or supplier to confirm firmware status and obtain an update.
  • Until a fix is confirmed, limit access to the device administration interface, disable remote management where possible and keep the extender off untrusted networks.
  • If no supported firmware becomes available, plan to retire or replace the device.
  • After any suspected compromise, restore the device from a trusted state and review its configuration, since the record notes that payloads persist in NVRAM.

Detection guidance

  • Review web management logs for requests to firewall.cgi that contain unusual or unexpected values in URL filter, host filter, port forwarding and IP filter parameters.
  • Monitor for configuration changes to these rule sets that were not made by an administrator.
  • Watch for unexpected outbound connections originating from the extender.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed firmware version or details on other affected models.
  • The scores come from a single CNA source (VulnCheck). The record contains no NVD-assigned score.
  • The EPSS date in the record is later than the publication date, so the timing of that value should be verified against the live data source.

Frequently asked questions

What is the vulnerability in the WDR201A?

The record describes an OS command injection flaw in the firewall.cgi binary, where insufficient input validation in five request handlers can let crafted values reach the system shell. It is classified as CWE-78.

Is there a fixed version available?

The record does not list a fixed version or vendor patch. Contact the vendor or supplier to confirm the firmware status.

Is this CVE being actively exploited?

The record shows this CVE is not in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.