CVE-2026-41924Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the set_time or StartSniffer functions. Attackers can craft a POST request with specially crafted ampersand-delimited parameters to bypass input sanitization and execute commands with a maximum length of 31 bytes through the date command or channel parameter processing.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-05-04); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-04	2	Disclosure2
2026-05-05	1	Disclosure1

Full discourse3 posts

CVE@CVEnew157d
Disclosure
CVE-2026-41924 WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote… https://www.cve.org/CVERecord?id=CVE-2026-41924
Post summary
The post discloses CVE-2026-41924, an OS command injection flaw in the WDR201A WiFi Extender's makeRequest.cgi, noting potential unauthenticated remote exploitation, but provides no PoC, exploit code, or mitigation guidance.
00010194
57.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds157d
Disclosure
CVE-2026-41924 Unauthenticated OS Command Injection in WDR201A WiFi Extender Firmware LFMZX28040922V1.02 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41924
Post summary
The post announces CVE-2026-41924, an unauthenticated OS command injection in the WDR201A WiFi Extender firmware LFMZX28040922V1.02, without providing any PoC, exploit code, or mitigation details.
0000065
4.0K followersView on X
Infoflowcloud@infoflowcloud157d
Disclosure
🚨*CVE* CVE-2026-41924 WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote… https://www.cve.org/CVERecord?id=CVE-2026-41924 ----- Traducción: CVE-2026-41924 WDR… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑41924 as an OS command injection flaw in the WDR201A WiFi Extender, but no PoC, exploit, or patch details are included.
0000034
75 followersView on X

Explore more

Back to dashboard