CVE-2026-30704

Deeper analysis

CVE-2026-30704 is a high-severity vulnerability (CVSS v3.1 score of 9.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) affecting the WiFi Extender WDR201A, specifically hardware version V2.1 running firmware LFMZX28040922V1.02. The issue stems from the exposure of an unprotected UART interface via accessible hardware pads on the device's printed circuit board (PCB), classified under CWE-912 (Hidden Functionality). This allows unauthorized access to potentially sensitive hardware-level interfaces.

An attacker with the ability to exploit this vulnerability, as indicated by the CVSS metrics, can do so remotely over the network (AV:N) with low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N). Successful exploitation enables high-impact compromise of confidentiality (C:H) and availability (A:H), such as extracting sensitive data or disrupting device operations through the UART interface, while integrity remains unaffected (I:N) under an unchanged scope (S:U).

Advisories reference a detailed security research disclosure at https://mstreet97.github.io/security-research/iot/vulnerability-disclosure/cybersecurity/cve/2026/02/18/From-Blackbox-to-Whitebox-Multiple-CVEs-in-a-Consumer-WiFi-Extender.html, which covers this and other CVEs in the device, alongside manufacturer information for Yeapook (https://www.made-in-china.com/showroom/yeapook/#:~:text=Established%20in%202015.%2CDistrict%2C%20Shenzhen%2C%20Guangdong%2C%20China), a Shenzhen-based producer established in 2015; no specific patches or mitigations are detailed in the provided references.