CVE-2026-41925: Shenzhen Yipu Commercial And Trading Co., Ltd WDR201A Wifi Extender

Critical severity, CVSS 9.3. EPSS: 4.1% chance of exploitation in the next 30 days.

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the reboot_time POST parameter. Attackers can send a crafted request with shell metacharacters in the reboot_time parameter when reboot_enabled=1 to achieve remote code execution.

Affected products

• Shenzhen Yipu Commercial And Trading Co., Ltd WDR201A Wifi Extender: up to and including 1.02.0

Published 2026-05-04. Last modified 2026-06-17.