An OS command injection flaw exists in the wireless.cgi binary of the WDR201A WiFi Extender (hardware V2.1, firmware LFMZX28040922V1.02). Attackers may supply malicious input in the sz11gChannel or PIN POST parameters, which are passed unsanitized to the set_wifi_basic or set_wifi_do_wps functions, enabling arbitrary shell command execution. Because the vulnerability is triggered purely by HTTP POST requests and requires no authentication, any network host that can reach the device can potentially compromise the system.

The affected product is the Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender, model WDR201A (hardware version V2.1, firmware LFMZX28040922V1.02). No other vendors or versions are listed as affected.

The CVSS score of 9.3 reflects a high likelihood of successful exploitation and critical impact. The EPSS score is 1%, indicating a low but nonzero probability of exploitation in real world situations. The vulnerability is not listed in CISA KEV, but the combination of remote unauthenticated command injection and the device’s network‑facing nature makes it highly attractive to threat actors. Attackers need only send crafted POST requests to the wireless.cgi endpoint; no prior access or credentials are required.