Vulnerability · Published May 4, 2026 · Assigned by VulnCheck
CVE-2026-41926WDR201A WiFi Extender OS Command Injection via firewall.cgi
Critical 9.3
In plain English
A critical-severity OS command injection in WDR201A WiFi Extender from Shenzhen Yipu Commercial and Trading Co., Ltd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Yipu Commercial and Trading Co., Ltd | WDR201A WiFi Extender | 0 – through 1.02.0 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-research/cybersecurity/cve/2026/05/04/Teaching_the_Machine_Where_to_Look.html technical-description, exploit
- https://www.made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China product
- https://www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-firewall-cgi third-party-advisory