CVE-2026-41926
WDR201A WiFi Extender OS Command Injection Vulnerability
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) has an OS command injection vulnerability in its firewall.cgi binary. This vulnerability exists across five request handlers due to insufficient input validation. Attackers can exploit this by injecting arbitrary shell commands through vulnerable parameters such as websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter. The injected commands persist in the device's NVRAM and are re-executed on every subsequent firewall.cgi request.
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary shell commands on the affected device without any privileges or user interaction. Because the malicious commands persist in NVRAM and re-execute on each firewall.cgi request, an attacker can maintain persistent control or cause repeated harmful effects. This can lead to unauthorized access, device compromise, disruption of network services, or further attacks on connected systems.