Shenzhen Yuner WDR201A WiFi Extender Hardcoded Credential Disclosure Vulnerability

A vulnerability exists in the web interface of the Shenzhen Yuner WDR201A WiFi extender, specifically in hardware version 2.1 and firmware version LFMZX28040922V1.02. The issue arises from hardcoded credential disclosure mechanisms that utilize Server Side Includes (SSI) to expose the web administration password. This vulnerability is present in multiple server-side web pages, including login.shtml and settings.shtml, where the password is dynamically retrieved from non-volatile memory and displayed at runtime.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of administrative credentials, allowing an attacker to gain full administrative access to the device's web management interface.