CVE-2026-41927
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
77/100
Published: 2026-05-04
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
High
Description
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes. Attackers can exploit insufficient length validation in the fgets() call to achieve arbitrary code execution through return-oriented programming or return-to-libc techniques.