Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the reboot_time POST parameter. Attackers can send a crafted request with shell metacharacters in the reboot_time parameter when reboot_enabled=1 to achieve remote code execution.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-04 | 2 | Disclosure2 |
| 2026-05-05 | 1 | Disclosure1 |
CVE-2026-41925 WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthe… https://www.cve.org/CVERecord?id=CVE-2026-41925
Post summary
A new OS command injection vulnerability (CVE‑2026‑41925) was disclosed in the WDR201A WiFi Extender’s adm.cgi binary, allowing unauthenticated command execution.
CVE-2026-41925 Unauthenticated Remote Code Execution in WDR201A WiFi Extender via Command Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41925
Post summary
The post announces a new unauthenticated RCE vulnerability (CVE-2026-41925) in the WDR201A WiFi Extender, noting command injection, but offers no PoC, exploit code, or evidence of active exploitation.
🚨*CVE* CVE-2026-41925 WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthe… https://www.cve.org/CVERecord?id=CVE-2026-41925 ----- Traducción: CVE-2026-41925 WDR… http://infoflow.cloud`
Post summary
The message announces CVE-2026-41925—a command injection flaw in a WDR201A WiFi Extender—with basic technical details, but no evidence of proliferation or mitigation.