| शीर्षक | Tenda F6 (N300) Wireless Router Firmware V12.02.01.73 (Hardware V5.0) Cross-Site Request Forgery (CWE-352) |
|---|
| विवरण | The web management interface of the Tenda F6 (N300), firmware V12.02.01.73 (HW V5.0), does not implement anti-CSRF protection. State-changing actions are accepted as form POST requests with no anti-CSRF token and no SameSite restriction on the session cookie. By inducing an authenticated administrator to view a crafted web page, an attacker can silently trigger administrative actions, including factory restore (POST /goform/sysRestore with body "module1=sysOperate&action=restore"), device reboot, and administrator password change. Successful exploitation results in full device takeover and denial of service. The router's fixed default LAN address (192.168.0.1) makes a single exploit page effective against any affected device without reconnaissance. Confirmed on firmware V12.02.01.73 (HW V5.0); the latest firmware (V12.02.02.77) was not tested. |
|---|
| स्रोत | ⚠️ https://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md |
|---|
| उपयोगकर्ता | WKZER (UID 100459) |
|---|
| सबमिशन | 09/10/2026 05:04 PM (14 दिन पहले) |
|---|
| संयम | 23/10/2026 04:57 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 425974 [Tenda F6 12.02.01.73 Web Management Interface क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 20 |
|---|