CVE-2026-41923 is an OS command injection vulnerability affecting the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) from Shenzhen Yipu Commercial and Trading Co., Ltd. The vulnerability exists in the internet.cgi binary, specifically in the set_add_routing function, which improperly sanitizes the gateway POST parameter. This allows unauthenticated remote attackers to inject shell commands executed via popen(), with partial command output returned in HTTP responses. The vulnerability has a CVSS 4.0 score of 9.3, reflecting its critical impact and ease of exploitation without authentication or user interaction. No patch or official remediation is currently documented.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the affected device, potentially leading to full compromise of the device. This could enable attackers to manipulate device configuration, intercept or redirect network traffic, or use the device as a foothold for further attacks. The reflected partial command output in HTTP responses may aid attackers in crafting further exploits or confirming successful command execution.

No official patch or remediation guidance is currently available from the vendor. Since this is a device firmware vulnerability and the product is not a cloud service, remediation depends on the vendor releasing a firmware update that addresses the issue. Until a fix is available, affected devices should be isolated from untrusted networks to prevent exploitation. Monitor vendor communications for updates and apply firmware updates promptly once released.