| 标题 | Tenda AC10 V4.0 V16.03.10.09_multi_TDE01 Improper Authentication |
|---|
| 描述 | A vulnerability classified as critical was found in Tenda AC10 V4.0 (firmware US_AC10V4.0si_V16.03.10.09_multi_TDE01). The vulnerability exists in R7WebsSecurityHandler of the httpd binary, which is registered as the first-priority URL handler for all requests to the web management interface. Two whitelist checks in this function invoke strstr() against the raw request URL including the query string, while all other authentication logic operates on the stripped URL. Appending a whitelisted string such as "reasy-ui-1.0.3.js" as a query parameter causes the handler to return early without performing credential verification. The attack is remotely exploitable without authentication or user interaction, granting access to all protected endpoints including configuration download, firmware upload, and all administrative handlers. The vulnerability has been confirmed on physical hardware and responsibly disclosed to the vendor. |
|---|
| 来源 | ⚠️ https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md |
|---|
| 用户 | teiwiet (UID 98971) |
|---|
| 提交 | 2026-06-27 12時01分 (2 月前) |
|---|
| 管理 | 2026-08-15 07時25分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390174 [Tenda AC10 16.03.10.09_multi_TDE01 httpd R7WebsSecurityHandler 弱身份验证] |
|---|
| 积分 | 20 |
|---|