CVE-2026-41926 WDR201A WiFi Extender OS Command Injection via firewall.cgi
Attackers can execute arbitrary shell commands on the WDR201A WiFi Extender via insufficient input validation in firewall.cgi, leading to persistent code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41926?
CVE-2026-41926 is a critical command injection vulnerability in Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.
Weakness: CWE-78
Which versions are affected by CVE-2026-41926?
How do I fix CVE-2026-41926?
No fix has been published for CVE-2026-41926 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-41926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41926 exists.
Sources
Also known as GHSA-r939-4h6w-w7j6.