CVE-2026-41922: WDR201A WiFi Extender RCE Vulnerability

CVE-2026-41922 Overview

CVE-2026-41922 is an operating system command injection vulnerability [CWE-78] affecting the WDR201A WiFi Extender running hardware version 2.1 and firmware LFMZX28040922V1.02. The flaw resides in the wireless.cgi binary, where the set_wifi_basic and set_wifi_do_wps functions fail to sanitize input passed through the sz11gChannel and PIN POST parameters. Unauthenticated remote attackers can inject shell metacharacters into these parameters to execute arbitrary commands on the device. Successful exploitation grants attackers full control over the extender, enabling traffic interception, lateral movement, and persistent botnet recruitment.

Critical Impact
Unauthenticated remote code execution on affected WDR201A WiFi Extender devices via crafted POST requests to wireless.cgi.

Affected Products

WDR201A WiFi Extender, Hardware Version 2.1
WDR201A WiFi Extender, Firmware LFMZX28040922V1.02
The wireless.cgi binary handling set_wifi_basic and set_wifi_do_wps requests

Discovery Timeline

2026-05-04 - CVE-2026-41922 published to the National Vulnerability Database
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-41922

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in OS commands within the wireless.cgi CGI binary on the WDR201A WiFi Extender. The binary exposes wireless configuration endpoints reachable over the device's HTTP management interface without authentication. Two handler functions, set_wifi_basic and set_wifi_do_wps, accept user-supplied values from POST parameters and pass them into shell command invocations without validation or escaping. Attackers who can reach the device's web interface can inject arbitrary shell commands, which execute with the privileges of the web server process — typically root on embedded Linux extenders.

Root Cause

The root cause is unsanitized parameter handling in two C functions inside wireless.cgi. The set_wifi_basic handler concatenates the sz11gChannel POST value directly into a shell command string used to configure the wireless channel. Similarly, set_wifi_do_wps embeds the PIN POST value into a system command for WPS pairing. Neither handler enforces an allowlist of expected characters, applies length restrictions, nor uses safe execution APIs that separate command and arguments.

Attack Vector

Exploitation requires only network access to the extender's web management interface. An attacker sends an HTTP POST request to wireless.cgi containing a sz11gChannel or PIN field with shell metacharacters such as backticks, semicolons, or $() substitutions. The injected payload runs immediately on the device. Because no authentication is required, any host on the same broadcast domain — or any internet-exposed instance — can be compromised. See the VulnCheck Advisory on OS Command Injection for technical specifics.

Detection Methods for CVE-2026-41922

Indicators of Compromise

HTTP POST requests to /wireless.cgi containing shell metacharacters (;, |, `, $(), &&) inside the sz11gChannel or PIN parameters
Unexpected outbound connections from the WiFi extender to attacker-controlled infrastructure
New or modified processes spawned by the embedded web server, such as wget, curl, tftp, or busybox invocations originating from wireless.cgi
Unexplained changes to wireless configuration, DNS settings, or firmware on the device

Detection Strategies

Inspect HTTP traffic destined for the extender's management interface and alert on non-printable or shell-control characters in POST bodies targeting wireless.cgi
Baseline the extender's outbound traffic and flag deviations such as connections to non-RFC1918 destinations on uncommon ports
Correlate WPS pairing attempts and channel changes with the source IP performing them to surface unauthenticated configuration writes

Monitoring Recommendations

Place affected extenders behind a managed segment and forward DHCP, DNS, and NetFlow telemetry to a centralized analytics platform for behavioral baselining
Capture and review web access logs for the device, prioritizing requests that include URL-encoded shell operators against wireless.cgi
Continuously monitor for firmware integrity changes and unexpected reboots that may indicate post-exploitation persistence

How to Mitigate CVE-2026-41922

Immediate Actions Required

Restrict access to the extender's HTTP management interface to a dedicated administrative VLAN and block it at the perimeter
Disable WPS on the device to remove the set_wifi_do_wps exposure where the feature is not required
Power down or replace WDR201A units that are exposed to untrusted networks until a vendor patch is available
Audit any device sharing the broadcast domain for signs of lateral movement originating from the extender

Patch Information

No vendor-supplied firmware update has been published in the references available at the time of disclosure. Refer to the GitHub IoT Vulnerability Disclosure and the VulnCheck Advisory on OS Command Injection for the latest remediation status. Operators should track vendor channels for an updated firmware image that supersedes LFMZX28040922V1.02.

Workarounds

Place the extender behind a firewall rule that permits HTTP/HTTPS management traffic only from specific administrator workstations
Disable remote management features and ensure the WAN side of the device does not expose wireless.cgi
Where feasible, replace the affected hardware with a device that receives security updates and supports authenticated management

bash

# Example firewall rule restricting access to the extender management UI
# Replace 192.0.2.10 with the admin workstation and 198.51.100.5 with the extender
iptables -I FORWARD -p tcp -d 198.51.100.5 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -I FORWARD -p tcp -d 198.51.100.5 --dport 80 -j DROP