The WiFi Extender WDR201A firmware implements a broken authentication mechanism within its web management interface. The login page does not enforce proper session validation, allowing attackers to bypass authentication by directly accessing restricted endpoints via forced browsing. The weakness is a classic authentication bypass (CWE‑285) and enables an attacker to gain full control of the device’s configuration and settings without needing valid credentials.

The vulnerability affects the WiFi Extender WDR201A model, hardware version 2.1 and firmware LFMZX28040922V1.02. No other vendors or products are identified. The device is typically deployed in residential or small‑business networks.

The CVE carries a CVSS base score of 9.8, indicating a high‑severity vulnerability. The EPSS score is below 1 %, suggesting that exploitation is unlikely to be widespread; however, the device is usually accessible on local networks, making forced browsing feasible for attackers with network access. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it remotely by sending crafted HTTP requests to the management interface and bypass authentication altogether.