CVE-2026-41927 is a stack-based buffer overflow vulnerability affecting the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) by Shenzhen Yipu Commercial and Trading Co., Ltd. The issue exists in the firewall.cgi and makeRequest.cgi binaries due to improper length validation of POST requests with Content-Length headers exceeding 512 bytes. This allows unauthenticated attackers to overwrite the saved return address on the stack, facilitating arbitrary code execution through advanced exploitation techniques such as return-oriented programming or return-to-libc. The vulnerability is classified under CWE-121 and carries a CVSS 4.0 score of 8.3, indicating high severity. No patch or official remediation has been published, and the device is not a cloud service, so remediation depends on vendor action.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected device, potentially leading to full compromise of the WiFi extender. This can result in unauthorized control over device functionality and network traffic passing through it. The vulnerability is high severity with a CVSS score of 8.3, reflecting significant risk if exploited. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device and limiting exposure to untrusted networks may reduce risk. Avoid sending POST requests with large Content-Length headers to the affected binaries if possible.