Tenda AC9 CVE-2025-14286

Exploitation requires network access to the Tenda AC9 (firmware 15.03.05.14_multi) HTTP management interface and an unauthenticated request to the /cgi-bin/DownloadCfg.jpg path handled by the Configuration File Handler component - no credentials, user interaction, or special configuration are stated as required (AV:N/AC:L/PR:N/UI:N). The primary real-world LIMITING factor is reachability: most AC9 units expose the management interface only on the LAN by default, so widespread remote exploitation depends on the device having remote/WAN management enabled or the attacker already being on the local network; impact is confined to information disclosure (no integrity or availability effect).

This is a medium-severity information disclosure flaw (CWE-200) in the Tenda AC9 consumer router (firmware 15.03.05.14_multi) reachable via the /cgi-bin/DownloadCfg.jpg endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated access with no user interaction, which makes triggering trivial; however, impact is constrained to confidentiality only (VC:L, with VI:N/VA:N and no scope change), yielding the 5.5 base score. Multi-source signals are consistent but modest: EPSS is low at 0.68% (51st percentile), indicating no observed mass-exploitation pressure, and the SSVC/CVSS exploit-maturity flag E:P reflects a proof-of-concept rather than weaponized use. A public exploit exists (GitHub PoC), but the CVE is NOT on the CISA KEV list, so there is no confirmed active exploitation. Net: the easy, unauthenticated network reachability raises concern for internet-exposed devices, but the limited confidentiality-only impact and low EPSS place this as a moderate priority rather than an emergency - prioritize remediation on routers with management interfaces exposed to untrusted networks. One caveat: the endpoint name ('DownloadCfg') implies retrieval of a configuration file that could contain credentials, which would justify higher confidentiality impact than the input's VC:L; the exact sensitivity of the disclosed data is not confirmed from the provided description and should be verified against the PoC or vendor.

An attacker who can reach the router's web/management interface (e.g., a device with the admin interface exposed to the WAN or an attacker on the local network) sends a crafted HTTP request to /cgi-bin/DownloadCfg.jpg and retrieves disclosed configuration/information without authentication. A public proof-of-concept is available on GitHub, lowering the skill barrier. Given AV:N/AC:L/PR:N/UI:N, the request requires no credentials, no user interaction, and low complexity.