Description

Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T21:16:47.737Z",
  "pubdate": "2026-08-17T21:16:47.737Z",
  "executiveSummary": "An unauthenticated remote command execution and service activation vulnerability exists within the Tenda W20E V16.01.0.6(2782) firmware. The vulnerability resides in the /goform/telnet endpoint, which improperly permits unauthenticated external actors to interact with the device and forcefully initialize the underlying Telnet daemon.\nSuccessful exploitation of this flaw grants attackers complete, unrestricted root shell access to the targeted network device without requiring prior authentication credentials or interaction from a legitimate administrator.\nThe affected product is the Tenda W20E router running version V16.01.0.6(2782). The risk implications are severe, as unauthorized administrative access to a core network routing device allows malicious entities to intercept traffic, modify firewall rules, pivot deeper into internal network segments, or permanently disable the hardware via firmware corruption.\nAttacker capabilities include full system compromise at the highest privilege level (root). Exploitation requirements are minimal, necessitating only network connectivity to the vulnerable endpoint exposed by the router, typically via the local network or wide-area network if management interfaces are misconfigured and exposed.",
  "technicalDetails": "The vulnerability stems from improper access control and inadequate input validation within the web management interface of the Tenda W20E V16.01.0.6(2782) firmware. Specifically, the vulnerable component is the HTTP handler associated with the /goform/telnet endpoint.\nThe root cause of the issue is the lack of session validation, authentication checks, or authorization enforcement prior to executing internal system commands. When a remote HTTP request is sent to the /goform/telnet URI, the backend application logic processes the request and directly invokes system-level routines designed to start the Telnet daemon service (telnetd).\nThe attack flow proceeds as follows: An unauthenticated attacker crafts an HTTP request targeting the /goform/telnet endpoint on the router's web server. Upon receiving this request, the vulnerable endpoint fails to verify if the incoming connection originates from an authenticated session belonging to a legitimate administrator. Instead, the application trusts the input unconditionally and triggers the system initialization scripts to launch the Telnet service on its standard listening port.\nOnce the Telnet daemon is active, the attacker can establish a direct TCP connection to the device's Telnet port. Due to insecure default configurations or hardcoded administrative pathways exposed by the daemon initialization routine, the attacker is immediately granted a root shell interface.\nThe privilege level achieved post-exploitation is absolute root access, allowing the execution of arbitrary system binaries, inspection of sensitive configuration files containing plaintext credentials, manipulation of routing tables, and installation of persistent backdoors. The vulnerability is accessible over the network protocol stack, specifically targeting the HTTP/HTTPS management service exposed by the device. No privileges or credentials are required to initiate the attack flow."
}