| शीर्षक | Tenda AC9 V15.03.05.14_multi / V15.03.05.16_multi Improper Access Controls |
|---|
| विवरण | A vulnerability was found in Tenda AC9 firmware V15.03.05.14_multi and V15.03.05.16_multi. The issue affects the /goform/InsertWhite endpoint. Static analysis of R7WebsSecurityHandler shows that /goform/InsertWhite is hard-coded as an authentication-exempt path, allowing requests to reach the backend handler without a valid session.
The backend handler reads attacker-controlled mac and domain parameters. The mac value is only checked for length and hexadecimal characters, while the domain value is accepted after a length check. The values are then sent through tpi_talk_to_kernel to the netctrl component, which updates URL filtering and MAC filtering whitelist entries.
An unauthenticated attacker may be able to add arbitrary MAC and domain entries to the whitelist. This can weaken or bypass URL filtering and MAC filtering policy, allowing unauthorized devices or domains to evade configured access control restrictions.
Static evidence includes the authentication bypass comparison for /goform/InsertWhite in R7WebsSecurityHandler around 0x2f0d4 and the add_white_node logic around 0x8c6cc. |
|---|
| स्रोत | ⚠️ https://github.com/limou89/somevul/blob/main/Tenda_AC9_InsertWhite_Whitelist_Tamper.md |
|---|
| उपयोगकर्ता | sleep (UID 100148) |
|---|
| सबमिशन | 27/07/2026 05:45 PM (1 महीना पहले) |
|---|
| संयम | 06/09/2026 06:33 PM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 399464 [Tenda AC9 15.03.05.14 Web Management R7WebsSecurityHandler कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|