Tenda AC1206 Unauthenticated ATE Manufacturing Service Vulnerability

Vulnerability Overview Vulnerability ID: TENDA-AC1206-ATE-DEFAULT-UNAUTH-002 Vulnerability Types: CWE-306 (Missing Authentication for Critical Function), CWE-749 (Exposed Dangerous Method or Function) Core Issue: On Tenda routers, when in the factory default state with an empty password, the route is accessible without authentication. This triggers the hidden manufacturing/debug service (ATE service), which provides an interface for manufacturing and configuration operations via UDP port 7329. Scope of Impact Vendor: Tenda Product: AC1206 V1.0 RTL / F1203-class web UI Affected Firmware: - Firmware SHA256: - Firmware SHA256: - Firmware SHA256: Version: V15.03.06.23 Architecture: MIPS32 little-endian uClibc with debug information Impact: An attacker on the management/LAN network can start the factory manufacturing service, enabling actions such as rebooting, restoring factory settings, manipulating NVRAM, and modifying wireless/network configuration. This may lead to service interruption, configuration tampering, or further exploitation of the device. POC / Exploit Code POC Request: Expected Response: Expected Backend Effect (Pseudocode): Dynamic Verification (QEMU Container): Response: QEMU System Call Trace: Remediation 1. Remove the route and manufacturing handlers from the production firmware. 2. Factory functions should only be enabled when the device is in the factory default state with an empty password, and must be protected by a challenge/response mechanism and an authenticated administrator session. 3. Ensure that hidden service controls or manufacturing endpoints are not exposed when the device is in the factory default state with an empty password. 4. Add negative tests for , UDP/7329, and ATE commands, and incorporate them into the release QA process.

Goal Reached Thanks to every supporter — we hit 100%!

Tenda AC1206 Unauthenticated ATE Manufacturing Service Vulnerability

More from this source