CVE-2026-41925 is an OS command injection vulnerability in the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) by Shenzhen Yipu Commercial and Trading Co., Ltd. The vulnerability exists in the adm.cgi binary's reboot_time function, which improperly neutralizes special elements in the reboot_time POST parameter. When reboot_enabled=1, an unauthenticated remote attacker can inject shell metacharacters to execute arbitrary commands on the device, leading to remote code execution. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the affected device, potentially leading to full compromise of the WiFi extender. This can result in unauthorized control over the device, disruption of network services, and potential pivoting to other network assets. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its severe impact and ease of exploitation.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting network access to the device's management interface and disabling remote administration features, if possible, may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.