CVE-2026-41927 is a stack-based buffer overflow vulnerability affecting the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) from Shenzhen Yipu Commercial and Trading Co., Ltd. The issue exists in the firewall.cgi and makeRequest.cgi binaries, where an unauthenticated attacker can send a POST request with a Content-Length header exceeding 512 bytes. Due to insufficient length validation in the fgets() call, this allows overwriting of the saved return address on the stack. Successful exploitation can lead to arbitrary code execution through advanced techniques such as return-oriented programming or return-to-libc. The CVSS 4.0 score is 8.3 (high severity), reflecting network attack vector, high attack complexity, and no privileges or user interaction required. No official remediation or patch is currently available.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the affected device, potentially gaining control over the WiFi extender. This could lead to device compromise, disruption of network services, or use of the device as a foothold for further attacks. The high CVSS score indicates significant risk if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor for vendor updates. Until a patch is released, consider limiting network exposure of the device and applying network-level protections to restrict access to the vulnerable services.