PT-2026-26109 · D Link · Wifi Extender Wdr201A

Mstreet97 · Publicado 2026-03-18 · Atualizado 2026-03-19 · CVE-2026-30703

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02)

Description A command injection issue exists in the web management interface. The adm.cgi endpoint does not properly sanitize user-supplied input for a command-related parameter within the sysCMD functionality. This could allow for unauthorized command execution.

Recommendations Apply updates to address the improper input sanitization in the adm.cgi endpoint and the sysCMD functionality.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-30703

Produtos afetados

Wifi Extender Wdr201A

Referências · 4

• 🔥 https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/cybersecurity/cve/2026/02/18/From-Blackbox-to-Whitebox-Multiple-CVEs-in-a-Consumer-WiFi-Extender.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30703 · Nota de Segurança
• https://made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China · Nota
• https://twitter.com/CVEnew/status/2034520441876861140 · Publicação no Twitter