The flaw is an OS command injection vulnerability in the adm.cgi binary’s reboot_time function of the WDR201A WiFi Extender. When reboot_enabled is set to 1, an unauthenticated attacker can supply crafted input containing shell metacharacters in the reboot_time POST parameter, causing the device to execute arbitrary shell commands. This represents a full remote code execution capability per CWE‑78, allowing attackers to read, modify, or delete any data on the device and potentially use the extender as a pivot point for broader network attacks.

The affected products are Shenzhen Yipu Commercial and Trading Co., Ltd’s WDR201A WiFi Extender. The specific hardware version is V2.1 and the firmware version identified is LFMZX28040922V1.02. No other vendor or product versions are listed as vulnerable in the available data.

The CVSS score of 9.3 places this vulnerability in the critical range, indicating a high potential impact and ease of exploitation. The EPSS score is not available, but the lack of validation or authentication combined with the ability to use any HTTP client to send the malicious POST request suggests a high likelihood of real-world exploitation. The vulnerability is not catalogued in the CISA KEV list, yet its exploitation could lead to device takeover, lateral movement, and compromise of any networks connected through the extender.