216.73.217.64

CVE-2026-41926

· Published 04/05/2026 20:16 · Modified 04/05/2026 20:16

Labels: CVE-2026-41926 2026-05-04CVE-2026-41926CWE-78[email protected]

Essential information

Published
04/05/2026 20:16
Modified
04/05/2026 20:16
Author
Creator
CVSS
9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV
No
CWE
CVSS vector

CVSS metrics

Description

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
wdr / wdr201a wifi extender cpe:2.3:a:wdr:wdr201a_wifi_extender:LFMZX28040922V1.02:*:*:*:*:*:*:*

References