Description

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-31T13:18:29.773Z",
  "pubdate": "2026-08-31T13:18:29.773Z",
  "executiveSummary": "A critical authentication bypass vulnerability has been identified in the Tenda AC1206 router, specifically within the firmware version 15.03.06.23. The vulnerability resides in the R7WebsSecurityHandler function located within the /goform/ate web component.\nThis flaw allows remote, unauthenticated attackers to bypass security controls implemented within the web interface. By manipulating the affected handler, an unauthorized actor can gain access to restricted administrative functionality or internal system states without providing valid credentials.\nThe vulnerability presents a significant risk, as it facilitates unauthorized remote administrative access. Given that exploit code is publicly available, the risk of exploitation is elevated. Impact includes potential unauthorized configuration changes, device compromise, and further integration into malicious botnets. No special user interaction is required, and the attack can be executed over standard network protocols, making this a high-severity remote vulnerability for users of the affected firmware version.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the R7WebsSecurityHandler function within the /goform/ate endpoint of the Tenda AC1206 Web UI component. This function is designed to enforce access control policies for incoming HTTP requests; however, it fails to properly validate the authenticity of the session before processing the request.\nThe root cause is a logic error in the session verification process where the application incorrectly handles the security context for requests directed at the /goform/ate path. Because the security handler does not adequately verify the presence or validity of authentication tokens, it essentially treats unauthenticated requests as authorized interactions.\nExploitation is straightforward and can be conducted remotely over HTTP/HTTPS. An attacker identifies the target endpoint, /goform/ate, and sends crafted POST or GET requests that leverage the flawed handler. Because the R7WebsSecurityHandler logic is bypassed, the web server executes the underlying functions associated with /goform/ate without requiring the attacker to authenticate. This often leads to the execution of diagnostic or configuration commands that were intended to be protected by administrative password requirements.\nThe attack flow proceeds as follows: 1) The attacker initiates a network connection to the Tenda AC1206 web interface. 2) The attacker crafts a request targeting the vulnerable /goform/ate endpoint. 3) The R7WebsSecurityHandler, responsible for intercepting and validating the request, fails to trigger a redirect or access-denied response due to improper condition checking. 4) The application processes the request, executing the requested command or revealing sensitive information. 5) The attacker successfully performs actions meant for an authenticated administrator.\nThis vulnerability is particularly dangerous because it bypasses the entire authentication stack of the administrative web portal. Post-exploitation impact typically involves unauthorized configuration modifications, enabling persistence mechanisms (such as adding malicious firmware configuration changes), or leveraging the device as a pivot point within the local area network. Since the exploit logic is publicly known, it can be weaponized with minimal effort by automated scanners or manual actors, leading to widespread compromise of vulnerable units exposed to the public internet."
}