The vulnerability resides in the wireless.cgi component of the WDR201A WiFi Extender and allows an attacker to inject arbitrary shell commands through the sz11gChannel or PIN POST parameters. Because the set_wifi_basic and set_wifi_do_wps functions do not sanitize these inputs, an unauthenticated remote user can execute commands on the device’s operating system. The weakness is identified as an OS command injection (CWE-78).

The affected product is the Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender, model WDR201A (hardware version V2.1, firmware LFMZX28040922V1.02). No other vendors or versions are listed as affected.

The CVSS score of 9.3 reflects a high likelihood of successful exploitation and critical impact. The EPSS score is not available, but given that the flaw allows unauthenticated remote code execution and the device is network-facing, the real-world risk is substantial. The vulnerability is not listed in CISA KEV, but its severity and lack of authentication requirements make it highly attractive to threat actors. Attackers would simply need to send crafted POST requests to the wireless.cgi endpoint; no prior access or credentials are required.