| タイトル | Tenda AC9 V15.03.05.14 Information Disclosure |
|---|
| 説明 | A vulnerability was found in Tenda AC9 firmware V15.03.05.14_multi. Several web management endpoints are reachable without authentication because they are included in an authentication-exempt URL list inside the httpd security handler.
The affected endpoints include /goform/getProduct, /goform/getWanConnectStatus and /goform/getRebootStatus. Static analysis shows that these paths are hard-coded in the auth-exempt logic handled by R7WebsSecurityHandler. As a result, unauthenticated remote attackers can directly query these endpoints without a valid session.
The /goform/getProduct endpoint discloses product identification information such as the internal product code and access type. The /goform/getWanConnectStatus endpoint discloses WAN connection status. The /goform/getRebootStatus endpoint discloses reboot state information. These responses may help attackers fingerprint the device, identify active targets, determine device state and prepare further attacks.
The issue was confirmed through static analysis and runtime validation against exposed devices returning HTTP 200 responses and JSON data from the affected endpoints. |
|---|
| ソース | ⚠️ https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md |
|---|
| ユーザー | sleep (UID 100148) |
|---|
| 送信 | 2026年07月27日 17:43 (1 月 ago) |
|---|
| モデレーション | 2026年09月06日 18:33 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 399464 [Tenda AC9 15.03.05.14 Web Management R7WebsSecurityHandler 弱い認証] |
|---|
| ポイント | 20 |
|---|