PT-2026-26107 · Unknown · Wifi Extender Wdr201A

Mstreet97 · Published 2026-03-18 · Updated 2026-03-19 · CVE-2026-30701

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions WiFi Extender WDR201A versions LFMZX28040922V1.02

Description The web interface of the WiFi Extender WDR201A contains hardcoded credential disclosure mechanisms. Specifically, server-side include vulnerabilities exist within multiple web pages, including login.shtml and settings.shtml. These vulnerabilities allow the exposure of the web administration password from non-volatile memory at runtime. The vulnerable pages embed server-side execution directives that dynamically retrieve and expose the password.

Recommendations Apply a firmware update that addresses the hardcoded credential disclosure in the web interface. As a temporary workaround, restrict access to the login.shtml and settings.shtml pages.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-30701

Affected Products

Wifi Extender Wdr201A

References · 4

• 🔥 https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/cybersecurity/cve/2026/02/18/From-Blackbox-to-Whitebox-Multiple-CVEs-in-a-Consumer-WiFi-Extender.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30701 · Security Note
• https://twitter.com/CVEnew/status/2034520440161354159 · Twitter Post
• https://made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China · Note