Buffer overflow in Shenzhen Yipu Commercial And Trading Co., Ltd Wdr201a Wifi Extender
CVE-2026-41927
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes. Attackers can exploit insufficient length validation in the fgets() call to achieve arbitrary code execution through return-oriented programming or return-to-libc techniques.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (45.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
Weakness classification (CWE)
References
- mstreet97.github.io/security-research/iot/vulnerability-disclosure/ai-assisted-… (technical-description, exploit)
- www.made-in-china.com/showroom/yeapook/ (product)
- www.vulncheck.com/advisories/wdr201a-wifi-extender-stack-based-buffer-overflow-… (third-party-advisory)