The WiFi Extender WDR201A (hardware version V2.1, firmware LFMZX28040922V1.02) contains an unprotected UART interface that is accessible through exposed hardware pads on the printed circuit board. This flaw allows an attacker to transmit commands directly to the device’s processor without authentication, leading to potential arbitrary code execution, privilege escalation, or other unauthorized actions. The vulnerability is classified as CWE‑912, which indicates an improper identification or use of a device interface as being insecure or exposed. The specific impact is that an entity with physical access to the device can compromise the extender, potentially allowing further propagation or misuse of the network.

The affected system is the Yeapook WiFi Extender model WDR201A, hardware version V2.1. The firmware in question is LFMZX28040922V1.02. No other vendors or product lines are listed as affected in the CVE entry.

The CVSS score of 9.1 indicates a high severity assessment. EPSS is below 1%, denoting a low probability of exploitation in the wild, and the vulnerability is not currently included in the CISA KEV catalog. Based on the description, the exploit requires physical proximity to the exposed UART pads, so the attack vector is likely local or requires an attacker who can physically reach the device. Even though the exploitability is limited by this requirement, the potential for full device compromise warrants serious attention if the hardware is in a potentially insecure environment.