The WDR201A WiFi Extender contains an OS command injection flaw in the makeRequest.cgi component that allows an attacker to run arbitrary shell commands. The vulnerability is triggered by crafting a POST request with ampersand‑delimited parameters that bypass input filtering in the set_time or StartSniffer functions. The injected commands are limited to a maximum length of 31 bytes and are executed through the date command or channel parameter processing, giving remote attackers the ability to compromise the device’s operating system or execute arbitrary scripts.

Affected systems are the Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender, hardware revision V2.1. The specific firmware susceptible to this issue is LFMZX28040922V1.02. No other versions or models are listed as vulnerable.

This vulnerability carries a CVSS score of 9.3, indicating very high severity. The EPSS score is not available, but the attacker only needs to send a single unauthenticated POST request to a publicly reachable endpoint, making exploitation straightforward. The flaw is not currently listed in the CISA KEV catalog, yet the lack of authentication constraints and the ability to execute shell commands make the risk significant for any deployed device.