CVE-2026-30703

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint improperly sanitizes user-supplied input provided to a command-related parameter in the sysCMD functionality.

Published 2026-03-18. Last modified 2026-06-17.