EUVD-2026-12878Lifecycle Timeline
3DescriptionCVE.org
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB
AnalysisAI
The WiFi Extender WDR201A (hardware version 2.1, firmware LFMZX28040922V1.02) contains an unprotected UART interface exposed through accessible PCB pads, allowing information disclosure through direct hardware access. An attacker with physical access to the device can connect to the UART pins to read sensitive data, firmware contents, or configuration information without authentication. No CVSS score, EPSS metric, or KEV status is currently available, but a proof-of-concept and detailed security research have been published, confirming the vulnerability's practical exploitability.
Technical ContextAI
The vulnerability stems from a lack of physical access controls and UART authentication mechanisms on the device's hardware interface. UART (Universal Asynchronous Receiver-Transmitter) is a common serial communication protocol used in embedded devices for debugging and firmware updates, typically accessible during manufacturing and development. The affected WiFi Extender model WDR201A exposes this UART interface through unprotected PCB pads that can be soldered or connected to without requiring any special tools beyond basic electronics equipment. This falls under improper access control and information disclosure (related to CWE-284: Improper Access Control), as the device fails to implement authentication, encryption, or physical tamper detection on the UART debug interface. The root cause is inadequate secure hardware design practices during device development, where debug interfaces were not disabled or protected in production firmware.
RemediationAI
Owners of the affected WDR201A (HW V2.1, FW LFMZX28040922V1.02) should contact the manufacturer to determine if a firmware update is available that disables or protects the UART interface. If a patch is available, apply it immediately to production devices. As an interim mitigation, restrict physical access to affected devices by placing them in secure, monitored locations or within locked equipment cabinets to prevent unauthorized UART access. Organizations should also conduct an inventory of affected devices and assess whether any credentials, keys, or sensitive data may have been exposed if devices have been in untrusted environments (e.g., returned for service, refurbished units, or supply chain handling). For new deployments, verify that replacement units or alternative WiFi extender models implement secure hardware design practices, including disabled or authenticated debug interfaces. Manufacturers should consult the detailed security research at https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/cybersecurity/cve/2026/02/18/From-Blackbox-to-Whitebox-Multiple-CVEs-in-a-Consumer-WiFi-Extender.html for comprehensive remediation guidance and hardware design recommendations.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 8.8). Risk factors: public PoC available
CVE-2025-34023 is a path traversal vulnerability in Karel IP1211 IP Phone's web management panel that allows remote auth
CVE-2025-48466 is a security vulnerability (CVSS 8.1). Risk factors: public PoC available.
MajorDoMo's unauthenticated /objects/?op=set endpoint fails to sanitize property values, allowing remote attackers to in
CVE-2025-7503 is a security vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affect
Command injection via the hostname field allowing authenticated code execution with maximum CVSS 10.0 and scope change.
Synectix LAN 232 TRIO serial-to-ethernet adapter exposes its web management interface without authentication (CVSS 10.0)
An API authentication bypass allows unauthenticated attackers to impersonate legitimate users. Maximum CVSS 10.0 with sc
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today