CVE-2026-41923

CRITICAL9.3

WDR201A WiFi Extender OS Command Injection via internet.cgi

Published May 4, 2026

Modified 2 weeks ago

Details

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit unsanitized parameter concatenation in the set_add_routing function to inject shell commands that are executed via popen() with partial output reflected in the HTTP response.

References

DETECTION

https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-research/cybersecurity/cve/2026/05/04/Teaching_the_Machine_Where_to_Look.html

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-41923

WEB

https://www.made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China

ADVISORY

https://www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-internet-cgi

CVSS Analysis

CVSS v4.0

9.3