CVE-2026-30702 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) i… | CVSS 9.8 CRITICAL

Description

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoints through forced browsing

Metadata

CVE ID: CVE-2026-30702
State: PUBLISHED
Assigner: mitre
Reserved: 2026-03-04 00:00 UTC
Published: 2026-03-18 00:00 UTC
Last updated: 2026-03-23 15:56 UTC
Primary CWE: CWE-285
CWE-285 Improper Authorization
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-285	adp	CWE-285 Improper Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)