CVE-2026-41922 is an OS command injection vulnerability affecting the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) by Shenzhen Yipu Commercial and Trading Co., Ltd. The issue exists in the wireless.cgi binary where unauthenticated attackers can inject malicious commands via the sz11gChannel or PIN POST parameters. The vulnerability is due to improper neutralization of special elements in these parameters within the set_wifi_basic and set_wifi_do_wps functions, allowing remote code execution without authentication. The CVSS 4.0 base score is 9.3 (critical). No patch or official remediation has been published, and the device is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the affected device, potentially leading to full compromise of the WiFi extender. This can result in unauthorized control over device functionality and network traffic passing through the device. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for unusual activity. Avoid exposing the device management interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.