Description

A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-31T13:18:29.580Z",
  "pubdate": "2026-08-31T13:18:29.580Z",
  "executiveSummary": "A critical vulnerability exists in Tenda AC1206 version 15.03.06.23 within the Web UI component, specifically identified as a missing authentication flaw.\nThis vulnerability allows remote, unauthenticated attackers to bypass security controls and potentially gain unauthorized access to the telnet interface.\nThe flaw resides within the TendaTelnet function located in the /goform/telnet file, which fails to properly validate or enforce authentication requirements during interaction.\nExploitation of this vulnerability does not require prior knowledge of legitimate user credentials, allowing a remote threat actor to interact with the system via telnet protocols.\nThe risk implication is severe, as successful exploitation enables an attacker to establish unauthorized administrative command-line access to the device.\nThe vulnerability is publicly disclosed, significantly increasing the probability of exploitation by malicious actors.\nThe attack is remotely executable, meaning the device does not need to be physically accessed, assuming the Web UI or associated management interfaces are reachable over the network.",
  "technicalDetails": "The vulnerability is categorized as an improper authentication flaw within the Tenda AC1206 firmware version 15.03.06.23. The root cause is a failure in the TendaTelnet function, which is responsible for managing telnet access requests processed via the /goform/telnet URI in the device's Web UI.\nUnder standard operating conditions, access to sensitive management services, such as a telnet shell, should be gated by a robust authentication mechanism to verify the identity and permissions of the requester. In this instance, the TendaTelnet function fails to execute the necessary authentication checks before initializing or exposing the telnet service or its configuration settings.\nThe exploitation process involves sending a specifically crafted request to the /goform/telnet endpoint on the vulnerable device. Because the function lacks adequate security controls, it treats the request as valid without verifying the presence of a session token or administrative credentials. By manipulating this endpoint, an attacker can trigger the service state transition that enables or exposes the telnet interface remotely.\nOnce the telnet interface is enabled or accessed through this unauthenticated pathway, the attacker can establish a session directly with the underlying operating system. This grants the attacker command-line interface (CLI) access to the device's environment. Given the nature of telnet, the attacker operates with the privileges defined by the service, which, in embedded firmware contexts, is typically root or an equivalent high-privilege account.\nThe attack flow follows these steps: First, the attacker identifies the target device's Web UI interface over the network. Second, the attacker transmits a crafted payload to /goform/telnet. Third, the TendaTelnet function, failing to enforce authentication, processes the request and enables the unauthorized access mechanism. Finally, the attacker connects via the telnet protocol to the target device, bypassing all required authentication steps to gain full control of the device shell.\nThis vulnerability represents a significant security oversight, as it exposes the administrative console to the public or internal network without any barrier to entry. The impact post-exploitation includes full device compromise, potential firmware modification, persistent access for the attacker, and the ability to utilize the device as a pivot point for further network infiltration."
}