Beveiligingsadvies

CVE-2026-41926

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-04 19:17:52

Laatst bijgewerkt 2026-05-18 20:17:15

Toegewezen door VulnCheck

CVSS-score 9.3

Status PUBLISHED

Beschrijving

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter using subshell syntax or unfiltered parameters, with payloads persisting in NVRAM and re-executing on every subsequent firewall.cgi request.

← Alle CVE's bekijken Bekijk op cve.org ↗