CVE-2026-41923

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit unsanitized parameter concatenation in the set_add_routing function to inject shell commands that are executed via popen() with partial output reflected in the HTTP response.

CVSS

No CVSS.

References

Link	Resource
https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-research/cybersecurity/cve/2026/05/04/Teaching_the_Machine_Where_to_Look.html
https://www.made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China
https://www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-internet-cgi

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Extensor WiFi WDR201A (HW V2.1, FW LFMZX28040922V1.02) contiene una vulnerabilidad de inyección de comandos del sistema operativo en el binario internet.cgi que permite a atacantes remotos no autenticados ejecutar comandos de shell arbitrarios inyectando entrada maliciosa en el parámetro POST ’gateway’. Los atacantes pueden explotar la concatenación de parámetros no saneados en la función set_add_routing para inyectar comandos de shell que se ejecutan a través de popen() con salida parcial reflejada en la respuesta HTTP.

Information

Published : 2026-05-04 20:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-41923

Mitre link : CVE-2026-41923

CVE.ORG link : CVE-2026-41923

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-41923", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41923", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-05T13:09:28.051896Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Shenzhen Yipu Commercial and Trading Co., Ltd", "product": "WDR201A WiFi Extender", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.02.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-04T20:16:19.017", "references": [{"url": "https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-research/cybersecurity/cve/2026/05/04/Teaching_the_Machine_Where_to_Look.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-internet-cgi", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit unsanitized parameter concatenation in the set_add_routing function to inject shell commands that are executed via popen() with partial output reflected in the HTTP response."}, {"lang": "es", "value": "Extensor WiFi WDR201A (HW V2.1, FW LFMZX28040922V1.02) contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el binario internet.cgi que permite a atacantes remotos no autenticados ejecutar comandos de shell arbitrarios inyectando entrada maliciosa en el par\u00e1metro POST \u2019gateway\u2019. Los atacantes pueden explotar la concatenaci\u00f3n de par\u00e1metros no saneados en la funci\u00f3n set_add_routing para inyectar comandos de shell que se ejecutan a trav\u00e9s de popen() con salida parcial reflejada en la respuesta HTTP."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "disclosure@vulncheck.com"}