CVE-2026-30703

Command Injection in WiFi Extender Web Interface Leading to Remote Code Execution

View on CVE.org
Published Mar 18, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Description
A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint improperly sanitizes user-supplied input provided to a command-related parameter in the sysCMD functionality.

Analysis

AI-generated

Technical impact

A command injection flaw exists in the adm.cgi endpoint of the WiFi Extender WDR201A’s web management interface. The sysCMD functionality fails to sanitize user input for a command‑related parameter, allowing an attacker to execute arbitrary shell commands on the device. This weakness, identified as CWE‑78, could be used to compromise the integrity, confidentiality, and availability of the extender and the network it serves.

Affected Systems

The vulnerability impacts the WiFi Extender WDR201A, hardware version 2.1 running firmware LFMZX28040922V1.02. No other models or firmware versions are listed as affected.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests low current exploitation prevalence. The flaw is not cataloged in the CISA KEV list. The attack vector is inferred to be remote, via the device’s exposed HTTP-based management interface, and would require only unauthenticated or low‑privilege access to the web UI.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update that resolves the command injection flaw for the WiFi Extender WDR201A.
  • If a firmware patch is unavailable, disable or remove the sysCMD feature from the web management interface or restrict access to the management port to a trusted local network segment.
  • Implement firewall rules to block external access to the extender’s web interface and enforce strong authentication if the device supports it.
  • Consider replacing the device with a model that has no known vulnerabilities if patching or disabling features is not feasible.

Generated by OpenCVE AI on March 23, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Command Injection in WiFi Extender Web Interface Leading to Remote Code Execution
Type Values Removed Values Added
Weaknesses CWE-78
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Shenzhen Yuner Yipu
Shenzhen Yuner Yipu wdr201a
Vendors & Products Shenzhen Yuner Yipu
Shenzhen Yuner Yipu wdr201a
Type Values Removed Values Added
Description A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint improperly sanitizes user-supplied input provided to a command-related parameter in the sysCMD functionality.
References
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Mar 23, 2026, 3:56 PM
Reserved
Mar 4, 2026, 12:00 AM

View source JSON

Updated
Mar 23, 2026, 3:50 PM

JSON

Status
Awaiting Analysis
Published
Mar 18, 2026, 6:16 PM
Modified
Jun 17, 2026, 10:32 AM

View source JSON

No data.

Updated
Mar 24, 2026, 10:53 AM

JSON