CVE-2026-30702

CRITICAL

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation,...

Affects 0 products across 1 vendor.

CVSS 3.19.8
EPSS0.7%
Percentile53th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-285: CWE-285
Related Attack Patterns (CAPEC)
CAPEC-5 Blue Boxing
via CWE-285
CAPEC-13 Subverting Environment Variable Values
via CWE-285
CAPEC-45 Buffer Overflow via Symbolic Links
via CWE-285
CAPEC-51 Poison Web Service Registry
via CWE-285
CAPEC-59 Session Credential Falsification through Prediction
via CWE-285
Show all 17

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) has a broken authentication mechanism in its web management interface, allowing unauthorized access to restricted endpoints.

BSID: BS-2026-GLOBAL-079769-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-30702?
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) has a broken authentication mechanism in its web management interface, allowing unauthorized access to restricted endpoints.
What is the CVSS score for CVE-2026-30702?
CVE-2026-30702 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.7%.
Is CVE-2026-30702 actively exploited?
No confirmed active exploitation of CVE-2026-30702 as of 2026-09-25.
How do I remediate CVE-2026-30702?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-30702?
CVE-2026-30702 affects Enforce.
Vulnerability Details
CVE IDCVE-2026-30702
BSIDBS-2026-GLOBAL-079769-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2026-03-18
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-285
SourceNVD
Official Description

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoints through forced browsing

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can bypass authentication by directly accessing restricted web application endpoints through forced browsing due to improper session validation on the login page.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Enforce — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 211 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc222d653c7769591418d1fa5b62dc2ad18613bd2589776b6575b0de6f5244858a90b13b73204ef5aa127e03cf642e3b1114ad1b56f32f1f9bbc5d44072cc9436
Related CVEs affecting Enforce
CVE-2025-64128 10.0 An OS command injection vulnerability exists due to incomplete validation of... CVE-2026-42864 9.9 FireFighter is an incident management application. Prior to 0.0.54, the POST ... CVE-2025-55398 9.8 An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork... CVE-2025-14346 9.8 WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce a... CVE-2025-5095 9.8 Burk Technology ARC Solo's password change mechanism can be utilized without ...
View all Enforce CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →