EUVD-2026-12874Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoints through forced browsing
AnalysisAI
This vulnerability implements a broken authentication mechanism in the WiFi Extender WDR201A (hardware version 2.1, firmware LFMZX28040922V1.02) web management interface, allowing attackers to bypass login controls through forced browsing of restricted endpoints without valid session validation. An attacker can directly access administrative functions and sensitive configuration pages by circumventing the authentication layer entirely. A proof-of-concept and detailed technical analysis have been published by security researchers, indicating this is a practical, demonstrable vulnerability affecting consumer-grade networking equipment with no official CVSS scoring yet assigned.
Technical ContextAI
The vulnerability involves a broken authentication implementation (CWE root cause class) in the web-based management interface of the WDR201A WiFi extender. The device fails to properly enforce session validation when users attempt to access restricted administrative endpoints, instead relying on client-side or easily-bypassable authentication checks. This is a common flaw in consumer IoT and networking devices where developers implement authentication through simple parameter checking or missing access control verification on backend handlers, rather than enforcing server-side session tokens and authentication gates on every protected resource. The affected firmware version LFMZX28040922V1.02 on hardware revision 2.1 does not validate that an unauthenticated user lacks the necessary session credentials before serving sensitive configuration pages, allowing direct traversal to admin functions via HTTP GET or POST requests.
RemediationAI
The primary remediation is to contact the device manufacturer for a firmware update that properly implements session validation and authentication enforcement; users should check the vendor's support page or the provided research disclosure for patch availability and timeline. If a firmware update is available, upgrade immediately to a version released after February 2026 that addresses this authentication bypass. Until a patch is deployed, apply compensating controls: isolate the device on a restricted network segment with firewall rules blocking unauthorized access to the management interface, change any default credentials to complex passwords, disable remote management access if available, and monitor for suspicious access attempts to the device's HTTP/HTTPS ports (typically 80/443 or 8080/8443). Consider replacing the device with an alternative that implements proper authentication standards if the vendor does not provide a timely security update.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today