Critical severityNVD Advisory· Published May 4, 2026· Updated May 26, 2026

CVE-2026-41922

Description

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the wireless.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the sz11gChannel or PIN POST parameters. Attackers can exploit unsanitized parameter handling in the set_wifi_basic and set_wifi_do_wps functions to achieve remote code execution without authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WDR/201A WiFi Extenderllm-create

Patches

Vulnerability mechanics

References

mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-research/cybersecurity/cve/2026/05/04/Teaching_the_Machine_Where_to_Look.htmlnvd
www.made-in-china.com/showroom/yeapook/nvd
www.vulncheck.com/advisories/wdr201a-wifi-extender-os-command-injection-via-wireless-cginvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000