CVE-2026-41925 Overview
CVE-2026-41925 is an operating system (OS) command injection vulnerability in the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02). The flaw resides in the reboot_time function within the adm.cgi binary. Unauthenticated remote attackers can inject shell metacharacters into the reboot_time POST parameter when reboot_enabled=1 to execute arbitrary commands on the device. The vulnerability is tracked under CWE-78 and carries a CVSS 4.0 base score of 9.3.
Critical Impact
Unauthenticated remote attackers can execute arbitrary shell commands on affected WDR201A WiFi Extenders, leading to full device compromise and a foothold inside the local network.
Affected Products
- WDR201A WiFi Extender Hardware Version 2.1
- WDR201A Firmware LFMZX28040922V1.02
- Devices exposing the adm.cgi administrative interface
Discovery Timeline
- 2026-05-04 - CVE-2026-41925 published to the National Vulnerability Database (NVD)
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-41925
Vulnerability Analysis
The WDR201A WiFi Extender exposes an administrative HTTP endpoint served by adm.cgi. This binary handles configuration POST requests including a scheduled-reboot feature. The reboot_time handler reads the user-supplied reboot_time value and passes it into a shell command without sanitization or argument quoting. Because the input flows directly into a system command execution call, attackers can append shell metacharacters such as ;, |, &, or backticks to break out of the intended argument and execute arbitrary commands. Exploitation requires no authentication and a single HTTP POST request, allowing trivial weaponization across exposed devices.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The reboot_time function concatenates attacker-controlled input from the POST body into a shell invocation. The condition reboot_enabled=1 activates the vulnerable code path. No input validation, allowlisting, or safe-exec API is applied before the value reaches the shell.
Attack Vector
An attacker sends a single crafted HTTP POST request to the adm.cgi endpoint over the network. The request sets reboot_enabled=1 and embeds shell metacharacters within the reboot_time parameter. Commands execute with the privileges of the web service, which on embedded WiFi extenders typically run as root. This grants complete control over the device, including credential theft, persistence, traffic interception, and lateral movement into the connected network.
For full technical details, refer to the VulnCheck Advisory WDR201A and the GitHub Vulnerability Disclosure.
Detection Methods for CVE-2026-41925
Indicators of Compromise
- POST requests to /adm.cgi containing shell metacharacters (;, |, &, `, $()) inside the reboot_time parameter
- HTTP requests where reboot_enabled=1 is paired with non-numeric reboot_time values
- Outbound connections from the WiFi extender to unexpected hosts shortly after configuration POSTs
- Unscheduled spawning of sh, wget, curl, tftp, or busybox child processes by the web server
Detection Strategies
- Inspect HTTP traffic to embedded device management interfaces for parameter values containing shell special characters.
- Build network identifications that flag POSTs to adm.cgi with reboot_time values that do not match expected time formats.
- Correlate administrative HTTP activity with subsequent process execution or DNS lookups originating from the device subnet.
Monitoring Recommendations
- Log and review all administrative requests to consumer networking devices on the management VLAN.
- Alert on inbound or LAN-side connections to WiFi extenders from non-administrator hosts.
- Capture full HTTP POST bodies on perimeter or inline sensors to enable retrospective hunting for reboot_time injection patterns.
How to Mitigate CVE-2026-41925
Immediate Actions Required
- Remove the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) from untrusted network segments until a fix is available.
- Block external access to the device's HTTP management interface and restrict LAN access to a dedicated administrative host.
- Reset device credentials and reconfigure the extender from a known-good state if compromise is suspected.
- Inventory all WDR201A units in the environment and verify firmware versions against the affected build.
Patch Information
No vendor patch is referenced in the published advisory at the time of disclosure. Monitor the VulnCheck Advisory WDR201A for updates and apply firmware updates immediately when the vendor publishes a fixed release.
Workarounds
- Disable the scheduled reboot feature so requests with reboot_enabled=1 are not processed by vulnerable handlers, where the device permits this configuration.
- Place the extender behind a firewall rule that drops all inbound HTTP traffic except from a single management IP address.
- Replace affected hardware with a supported device if the vendor does not issue a timely firmware update.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
