| 제목 | Tenda AC9 V15.03.05.14_multi / V15.03.05.16_multi Improper Access Controls |
|---|
| 설명 | A vulnerability was found in Tenda AC9 firmware V15.03.05.14_multi and V15.03.05.16_multi. The issue affects the /goform/fast_setting_wifi_set endpoint. Static analysis of R7WebsSecurityHandler shows that URLs beginning with /goform/fast_setting are treated as authentication-exempt and return success from the security handler without requiring a valid session.
The backend handler form_fast_setting_wifi_set reads the loginPwd parameter from the HTTP request and writes it to the sys.userpass configuration key. The handler then commits the configuration to persistent storage. Because the endpoint is reachable without authentication, a remote attacker can submit a crafted request containing a new password hash and change the administrator password.
Successful exploitation allows the attacker to log in with the newly set administrator password and take full control of the router web management interface. This may lead to configuration modification, further information disclosure, network policy changes or complete device compromise.
Static evidence includes the authentication bypass condition in R7WebsSecurityHandler around 0x2f0d4 and the password update logic in form_fast_setting_wifi_set around 0x66f54. |
|---|
| 원천 | ⚠️ https://github.com/limou89/somevul/blob/main/Tenda_AC9_fast_setting_wifi_set_Unauth_Password.md |
|---|
| 사용자 | sleep (UID 100148) |
|---|
| 제출 | 2026. 07. 27. PM 05:44 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 06. PM 06:33 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 399464 [Tenda AC9 15.03.05.14 Web Management R7WebsSecurityHandler 약한 인증] |
|---|
| 포인트들 | 0 |
|---|