The vulnerability is an OS command injection in the firewall.cgi component of the WDR201A WiFi Extender, which allows an attacker to supply arbitrary shell commands via parameters such as websURLFilter, websHostFilter, portForward, singlePortForward, and ipportFilter. The syscall is executed with subshell syntax or unfiltered input, and the payloads are stored in NVRAM so they run on every subsequent request to firewall.cgi. This flaw is a classic CWE‑78; the impact is the ability for an attacker to take full control of the device’s operating system, compromising confidentiality, integrity and availability of the network infrastructure.

Affected are the Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender, hardware version V2.1 with firmware LFMZX28040922V1.02. No other vendor or product versions are listed in the CNA data.

The vulnerability carries a CVSS score of 9.3, indicating a high severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is inferred to be local network or remote HTTP access to the device’s web interface, requiring the attacker to know the device’s address and authenticated or unauthenticated access to the affected CGI. The persistence of payloads in NVRAM raises the likelihood of repeated exploitation.