Server‑side include directives embedded in multiple web pages such as login.shtml and settings.shtml reveal the administrator password stored in non‑volatile memory when the pages are rendered. This flaw allows an attacker who can reach the device’s web interface to obtain the password and gain full control over the extender, bypassing authentication. The weakness stems from hard‑coded credential disclosure (CWE‑798) and results in a direct compromise of confidentiality, integrity, and availability of the network portion managed by the device.

Devices affected by this vulnerability are the WiFi Extender WDR201A, hardware version 2.1 running firmware LFMZX28040922V1.02 from the manufacturer Yeapook. No other vendor or product versions are currently listed as impacted.

The CVSS score of 9.1 indicates a high severity rating, while the EPSS score below 1% suggests limited current exploitation. Nevertheless, the flaw is publicly documented and could be exploited remotely by anyone with network access to the extender’s web management interface. The vulnerability is not yet listed in the CISA KEV catalog, but operators should treat it as a high‑risk exposure and act promptly. The likely attack vector is a web‑based request to any of the affected pages; an attacker need only deliver a simple HTTP request to the device’s IP address to trigger the credential disclosure.