CVE-2026-41926
Deferred Deferred - Pending Action
WDR201A WiFi Extender OS Command Injection Vulnerability

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: VulnCheck

Description
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-04
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-14
NVD
CVE-2026-41926
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) has an OS command injection vulnerability in its firewall.cgi binary. This vulnerability exists across five request handlers due to insufficient input validation. Attackers can exploit this by injecting arbitrary shell commands through vulnerable parameters such as websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter. The injected commands persist in the device's NVRAM and are re-executed on every subsequent firewall.cgi request.

Impact Analysis

This vulnerability allows attackers to execute arbitrary shell commands on the affected device without any privileges or user interaction. Because the malicious commands persist in NVRAM and re-execute on each firewall.cgi request, an attacker can maintain persistent control or cause repeated harmful effects. This can lead to unauthorized access, device compromise, disruption of network services, or further attacks on connected systems.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41926. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart