| tiêu đề | Tenda AC9 V15.03.05.14 Information Disclosure |
|---|
| Mô tả | A vulnerability was found in Tenda AC9 firmware V15.03.05.14_multi. Several web management endpoints are reachable without authentication because they are included in an authentication-exempt URL list inside the httpd security handler.
The affected endpoints include /goform/getProduct, /goform/getWanConnectStatus and /goform/getRebootStatus. Static analysis shows that these paths are hard-coded in the auth-exempt logic handled by R7WebsSecurityHandler. As a result, unauthenticated remote attackers can directly query these endpoints without a valid session.
The /goform/getProduct endpoint discloses product identification information such as the internal product code and access type. The /goform/getWanConnectStatus endpoint discloses WAN connection status. The /goform/getRebootStatus endpoint discloses reboot state information. These responses may help attackers fingerprint the device, identify active targets, determine device state and prepare further attacks.
The issue was confirmed through static analysis and runtime validation against exposed devices returning HTTP 200 responses and JSON data from the affected endpoints. |
|---|
| Nguồn | ⚠️ https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md |
|---|
| Người dùng | sleep (UID 100148) |
|---|
| Đệ trình | 27/07/2026 17:43 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 06/09/2026 18:33 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 399464 [Tenda AC9 15.03.05.14 Web Management R7WebsSecurityHandler xác thực yếu] |
|---|
| điểm | 20 |
|---|