Which versions of WDR201A WiFi Extender are affected by CVE-2026-41925?

CVE-2026-41925 is a critical remote code execution vulnerability affecting WDR201A WiFi Extenders (firmware ≤1.02) that allows unauthenticated attackers to execute arbitrary commands on affected…

Is there a public PoC exploit available for CVE-2026-41925?

Yes, a public proof-of-concept exploit is available for CVE-2026-41925. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-41925?

Within 24 hours: Inventory all WDR201A devices running firmware version 1.02 or earlier and isolate affected units from production networks. Within 7 days: Contact vendor for firmware updates or end-of-life guidance; if no patch timeline is provided, plan device replacement. Within 30 days: Deploy network segmentation to restrict WiFi extender administrative access and implement compensating controls (see below); complete migration away from vulnerable firmware or hardware.

WDR201A WiFi Extender CVE-2026-41925

Q: What is the CVSS score of CVE-2026-41925?

CVE-2026-41925 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-27124 CRITICAL

OS Command Injection (CWE-78)

2026-05-04 VulnCheck

Command Injection RCE Wdr201A Wifi Extender

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 22:16 vuln.today

CVSS changed

May 04, 2026 - 20:22 NVD

9.3 (CRITICAL)

DescriptionCVE.org

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the reboot_time POST parameter. Attackers can send a crafted request with shell metacharacters in the reboot_time parameter when reboot_enabled=1 to achieve remote code execution.

AnalysisAI

Remote code execution in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows unauthenticated attackers to execute arbitrary OS commands via the adm.cgi binary's reboot_time parameter. The vulnerability stems from unsanitized input handling in the reboot scheduling function, exploitable by sending crafted POST requests with shell metacharacters when reboot_enabled=1. Public exploit code exists (CVSS 9.3, SSVC: automatable/total impact), making this a critical priority for affected deployments despite no confirmed CISA KEV listing at time of analysis.

Technical ContextAI

This is a classic OS command injection (CWE-78) vulnerability in embedded device firmware. The WDR201A WiFi Extender's web management interface uses CGI binaries (adm.cgi) for administrative functions. The reboot_time function fails to sanitize user input before passing it to system shell commands, allowing attackers to break out of intended command context using shell metacharacters (e.g., semicolons, pipes, backticks). The affected firmware version (LFMZX28040922V1.02) appears to be manufactured by Shenzhen Yipu Commercial and Trading Co., a supplier of networking equipment. The vulnerability resides in pre-authentication code paths, meaning the web interface processes the malicious parameter before credential verification.

RemediationAI

No vendor-released patch has been identified at time of analysis - the manufacturer's advisory status and firmware update availability remain unconfirmed from provided sources. Without an official fix, organizations must implement immediate compensating controls: (1) Isolate affected WDR201A devices on dedicated network segments with strict firewall rules blocking external access to the web management interface (typically TCP ports 80/443), understanding this prevents remote management but is necessary to block exploitation. (2) Disable remote administration features entirely if supported by device configuration, though firmware limitations may prevent full mitigation. (3) If isolation is infeasible, consider replacing devices with alternative products from vendors with active security support programs. (4) Deploy network-based IDS/IPS rules to detect POST requests to /adm.cgi containing shell metacharacters in reboot_time parameters. Monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-adm-cgi-reboot-time and vendor channels for firmware updates.