| Título | Tenda AC18 (AC18V1.0BR) wireless router V15.03.05.05_multi ,V15.03.05.19 build 6318 Insufficient Verification of Data Authenticity |
|---|
| Descripción | The web-based firmware upgrade function of the Tenda AC18 (AC18V1.0BR) router accepts firmware images without verifying a digital signature, hash whitelist, version consistency, or any other proof of authenticity. The only checks performed on an uploaded image are format validation (header magic 0x27051956, type/validity fields) and a CRC32 integrity check, followed by a size check against the KernelFS partition.
An attacker on the LAN with any valid web-administrator credentials can upload a modified firmware image via POST /cgi-bin/upgrade (multipart field "upgradeFile"). The device accepts it, writes the entire image to the KernelFS flash partition, reboots, and executes the attacker-controlled startup scripts. The result is persistent, root-level arbitrary code execution that survives reboots and is indistinguishable from official firmware through the management UI (the reported version string does not change).
This was dynamically verified on live hardware: a self-built, unsigned, same-version repacked image containing a startup backdoor (telnetd -l /bin/sh) and attacker-controlled content injected into management web pages passed all device-side checks, was flashed, and executed on reboot. After reboot the device exposed an unauthenticated root shell on TCP port 23 bound to x.x.x.x (entire LAN). The root filesystem is a read-only squashfs image burned into flash, so the modification cannot be removed through the device UI; the only recovery is re-flashing official firmware.
Affected: V15.03.05.05_multi (fully verified on live hardware: upload -> flash -> execution); V15.03.05.19 build 6318 (same verification code path confirmed by static analysis; additionally, a 19-version rootfs embedded in a mixed image was accepted and executed by the 05-version upgrade path on live hardware).
CVSS 3.1: AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.9 High).
|
|---|
| Fuente | ⚠️ https://github.com/longqx223/Tenda-ac-18-V15.03.05.05-/blob/main/2026-10-19-Tenda-AC18-unsigned-firmware-update-advisory-EN.pdf |
|---|
| Usuario | Longqxxixi (UID 102230) |
|---|
| Sumisión | 2026-10-19 10:21 (hace 26 días) |
|---|
| Moderación | 2026-11-13 20:57 (25 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 437295 [Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318 Firmware Upgrade /cgi-bin/upgrade upgradeFile autenticación débil] |
|---|
| Puntos | 20 |
|---|