The vulnerability is an OS command injection flaw in the adm.cgi binary’s reboot_time function of the WDR201A WiFi Extender. When reboot_enabled is set to 1, an unauthenticated attacker can send a POST request containing shell metacharacters in the reboot_time parameter, causing the device to execute arbitrary shell commands. This represents a full remote code execution capability as defined by CWE-78, allowing attackers to read, modify, or delete any data on the device and potentially use the extender as a pivot point for broader network attacks.

The affected product is the Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender hardware version V2.1 running firmware LFMZX28040922V1.02. No other vendor, product, or firmware versions are listed as vulnerable in the available data.

The CVSS score of 9.3 places this vulnerability in the critical range, indicating a high potential impact and ease of exploitation. The EPSS score of 3% suggests that the vulnerability has a moderate likelihood of being targeted in the wild. Because the flaw allows unauthenticated HTTP POST requests to /adm.cgi from any source, the practical risk of real‑world exploitation is high. The vulnerability is not currently listed in the CISA KEV catalog, but its exploitation could lead to device takeover, lateral movement, and compromise of networks connected through the extender.