CVE-2026-41927

Name of the Vulnerable Software and Affected Versions WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02

Description A stack-based buffer overflow exists in the 'firewall.cgi' and 'makeRequest.cgi' binaries. Unauthenticated attackers can overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes. This is caused by insufficient length validation in the fgets() function, which can lead to arbitrary code execution using return-oriented programming or return-to-libc techniques.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.