Shenzhen Yipu WDR201A WiFi Extender up to 1.02 POST Request makeRequest.cgi fgets stack-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in Shenzhen Yipu WDR201A WiFi Extender up to 1.02. This impacts the function fgets of the file makeRequest.cgi of the component POST Request Handler. Such manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2026-41927. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Shenzhen Yipu WDR201A WiFi Extender up to 1.02 and classified as critical. Affected by this issue is the function fgets of the file makeRequest.cgi of the component POST Request Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes. Attackers can exploit insufficient length validation in the fgets() call to achieve arbitrary code execution through return-oriented programming or return-to-libc techniques.

The weakness was published by Daniele Berardinelli and Matteo Strada. The advisory is shared for download at mstreet97.github.io. This vulnerability is handled as CVE-2026-41927 since 04/22/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27127). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Wireless LAN Software

Vendor

• Shenzhen Yipu

Name

• WDR201A WiFi Extender

Version

• 1.02

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion