WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 has an OS command injection in internet.cgi that lets unauthenticated remote attackers supply a malicious gateway POST value, which the set_add_routing function concatenates unsafely and passes to popen(). The result is arbitrary shell commands executed with the privileges of the webserver process, enabling full compromise of the device. The vulnerability provides complete code‑execution capability, allowing attackers to install malware, hijack traffic, or pivot to other network assets.

Affected vendors and products include Shenzhen Yipu Commercial and Trading Co., Ltd’s WDR201A WiFi Extender model. The specific vulnerability applies to hardware version V2.1 running firmware LFMZX28040922V1.02. No other versions are listed as affected in the available data.

The CVSS score of 9.3 classifies this flaw as critical, indicating high exploitation likelihood and impact. While the EPSS score is not available, the absence of a KEV listing does not reduce the risk because the flaw allows unauthenticated remote command injection. The likely attack vector is a crafted HTTP POST request to internet.cgi over the public-facing interface, implying that any device exposed to the internet is vulnerable unless mitigated.