EUVD-2026-68506
GHSA-9225-239x-2hx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router Web UI over network
-
DeliverySend unauthenticated request to /goform/telnet
-
ExploitTendaTelnet enables telnet daemon
-
ExecutionConnect to open telnet service
-
PersistObtain root shell on device
-
ImpactControl routing and traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the AC1206 Web UI HTTP service and the ability to request the /goform/telnet endpoint handled by TendaTelnet; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special complexity is needed against the affected firmware 15.03.06.23. The practical limiting factor is exposure of the management interface: on a default deployment the Web UI is LAN-facing, so an attacker generally needs LAN/Wi-Fi access unless WAN-side remote management is enabled, in which case the endpoint is internet-exploitable. A follow-on telnet connection to the device is needed to leverage the newly enabled service. |
| Impact | The signals are largely consistent toward high priority: the CVSS 4.0 base is 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N and full VC:H/VI:H/VA:H, meaning trivial, unauthenticated network exploitation with total impact, and the vector already carries E:P (proof-of-concept exploit maturity), matching the reported publicly available POC. The realistic constraint is exposure: home/SOHO routers are usually behind NAT, so the network vector is most dangerous from the LAN side or where the Web UI/WAN management is internet-exposed. EPSS is not provided in the input, and the CVE is NOT in CISA KEV, so there is no confirmed evidence of active mass exploitation despite the public exploit - this is 'exploit exists' rather than 'exploited in the wild.' The subsequent-system impact metrics (SC:H/SI:H/SA:H) in the supplied vector look optimistic for a single-device flaw and are worth independent scrutiny. Overall: treat as a genuine high/critical for any exposed device, tempered by the fact that severity rests on VulDB's single-source assessment. |
| Exploit ScenarioDerived | An attacker with a network path to the router's Web UI - an untrusted device on the LAN/Wi-Fi, or the internet if remote management is exposed - sends a crafted unauthenticated HTTP request to /goform/telnet, invoking TendaTelnet to enable the telnet daemon. The attacker then connects over telnet to the now-open service and obtains a root shell, gaining full control over routing, DNS, and traffic. Public exploit code documenting this default-unauthenticated telnet access is available on GitHub, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 31, 2026
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.
Earlier versions of this analysis (1)
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) exposes an unauthenticated telnet-enablement endpoint, letting remote attackers reach the Web UI TendaTelnet handler at /goform/telnet without any credentials. Because the CVSS 4.0 vector rates full confidentiality, integrity, and availability impact (10.0), a successful attacker effectively gains privileged shell-level control of the router. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), and the issue was disclosed via VulDB.
RemediationAI
No vendor-released patch is identified at time of analysis - the only sources are VulDB entries and a GitHub proof-of-concept, with no fix version or Tenda advisory in the input. Monitor https://www.tenda.com.cn/ for updated AC1206 firmware superseding 15.03.06.23 and apply it once published. As compensating controls: ensure remote/WAN-side web management is disabled so /goform/telnet is not reachable from the internet (trade-off: administrators lose off-LAN management); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via firewall/ACL (trade-off: added network configuration); block inbound TCP/23 (telnet) at the perimeter and, if the router supports it, disable the telnet service so a successful call to the handler yields no reachable listener (trade-off: legitimate telnet-based diagnostics stop working); and consider replacing end-of-support consumer hardware if no firmware fix appears. Reference: https://vuldb.com/vuln/397181.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded Web UI of the Tenda AC1206, a consumer/SOHO Wi-Fi router, specifically the goform CGI-style handler TendaTelnet mapped to /goform/telnet. This handler toggles or launches the device's telnet daemon, which on Tenda/Broadcom-style firmware typically drops the caller to a BusyBox root shell. The root cause is CWE-306 (Missing Authentication for a Critical Function): the endpoint performs a security-sensitive action - enabling remote telnet administration - without verifying that the requester holds an authenticated administrative session. The single CPE, cpe:2.3:a:tenda:ac1206, confirms the Tenda AC1206 product line as the affected target.
Know when Ac1206 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated network request enables telnet/root access (PR:N/UI:N/AC:L) with full compromise of the device; scope unchanged as impact stays within the router.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Technical POC Analysis
The flaw is CWE-306 Missing Authentication for Critical Function, with CWE-862 Missing Authorization as a secondary class.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Tenda AC1206 routers running firmware 15.03.06.23 are vulnerable to unauthenticated remote authentication bypass, allowing attackers to enable telnet access and gain shell-level control of network infrastructure. This vulnerability poses direct risk to organizations using this router model, enabling potential lateral movement, data exfiltration, and network compromise. Publicly available exploit code exists for this vulnerability.
Disable HTTP/HTTPS remote management access via perimeter firewall rules; implement network segmentation isolating affected routers from sensitive systems; restrict administrative interface access via IP-based ACLs from known management networks only; disable non-essential services and features on affected devices; deploy intrusion detection monitoring for requests to /goform/telnet endpoint; enable detailed logging of telnet connection attempts and authentication events; plan replacement with routers from alternative vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint o
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interfac
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated a
Exploit-DB