Tenda AC1206 Pre-Auth Telnet Enablement Vulnerability (CWE-306) Analysis

TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001 Vulnerability Summary Vulnerability Overview Vulnerability Name: The Tenda AC1206 series router, in its default factory state, allows unauthenticated users to enable the Telnet service via the route. Vulnerability Type: CWE-306 (Missing Authentication for Critical Function) / CWE-862 (Missing Authentication). Trigger Conditions: When the device is in its default factory state with an empty password, unauthenticated requests can reach the Telnet enablement logic without any Cookie or password verification. Impact: Attackers can remotely enable Telnet, thereby gaining access to the management interface, which may lead to complete control of the device. Severity: CVSS 3.1 score 7.8 (High). Affected Scope Vendor: Tenda Product: AC1206 V1.0 RTL / F1203-class with Web UI Affected Firmware: 1. - Firmware package SHA256: - Firmware package SHA256: 2. (ntpd SHA256) - Firmware package SHA256: - Firmware package SHA256: Version String: Architecture: MIPS32 little-endian uClibc, not stripped, includes debug information. POC / Exploit Code POC Request: Expected Response: Expected Backend Effect (Real Firmware Runtime): Route Registration (Static Evidence): Authentication Boundary (Static Evidence): Telnet Command Execution Path (Static Evidence): Dynamic Verification (QEMU System Call Trace): Dynamic HTTP Proof: Remediation 1. Remove : Remove this physical/logical-only gate from the product build or compilation. 2. Enforce Authentication: Require all management sessions (including the initial boot state) to pass through authentication. 3. Disable Telnet: Disable Telnet entirely, or replace it with SSH configured with strong credentials. 4. Regression Testing: Add regression tests for hidden routes to prevent the reintroduction of unauthenticated entry points.

Goal Reached Thanks to every supporter — we hit 100%!

Tenda AC1206 Pre-Auth Telnet Enablement Vulnerability (CWE-306) Analysis

More from this source