إرسال #906606: Tenda AC9 V15.03.05.14 Information Disclosure

A vulnerability was found in Tenda AC9 firmware V15.03.05.14_multi. Several web management endpoints are reachable without authentication because they are included in an authentication-exempt URL list inside the httpd security handler.

The affected endpoints include /goform/getProduct, /goform/getWanConnectStatus and /goform/getRebootStatus. Static analysis shows that these paths are hard-coded in the auth-exempt logic handled by R7WebsSecurityHandler. As a result, unauthenticated remote attackers can directly query these endpoints without a valid session.

The /goform/getProduct endpoint discloses product identification information such as the internal product code and access type. The /goform/getWanConnectStatus endpoint discloses WAN connection status. The /goform/getRebootStatus endpoint discloses reboot state information. These responses may help attackers fingerprint the device, identify active targets, determine device state and prepare further attacks.

The issue was confirmed through static analysis and runtime validation against exposed devices returning HTTP 200 responses and JSON data from the affected endpoints.

• المصدر: ⚠️ https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md
• المستخدم: sleep (UID 100148)
• ارسال: 27/07/2026 05:43 PM (1 شهر منذ)
• الاعتدال: 06/09/2026 06:33 PM (1 month later)
• الحالة: تمت الموافقة
• إدخال VulDB: 399464 [Tenda AC9 15.03.05.14 Web Management R7WebsSecurityHandler توثيق ضعيف]
• النقاط: 20