Security Advisory

CVE-2026-41926

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-04 19:17:52

Last updated 2026-05-18 20:17:15

Assigner VulnCheck

CVSS score 9.3

State PUBLISHED

Description

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.

← Browse all CVEs View on cve.org ↗