WDR201A WiFi Extender OS Command Injection Vulnerability

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: VulnCheck

Description

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-05-04

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-41926

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) has an OS command injection vulnerability in its firewall.cgi binary. This vulnerability exists across five request handlers due to insufficient input validation. Attackers can exploit this by injecting arbitrary shell commands through vulnerable parameters such as websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter. The injected commands persist in the device's NVRAM and are re-executed on every subsequent firewall.cgi request.

Impact Analysis

This vulnerability allows attackers to execute arbitrary shell commands on the affected device without any privileges or user interaction. Because the malicious commands persist in NVRAM and re-execute on each firewall.cgi request, an attacker can maintain persistent control or cause repeated harmful effects. This can lead to unauthorized access, device compromise, disruption of network services, or further attacks on connected systems.

Hi! I’m here to help you understand CVE-2026-41926. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70