Tenda D151 and D301 Routers Unauthenticated Configuration Download Vulnerability

A vulnerability exists in Tenda D151 and D301 routers that allows remote attackers to download router configuration files, including admin credentials, without authentication. This is achieved by sending a request to the '/goform/getimage' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized access to router configuration files, including administrative passwords, which could lead to further exploitation of the device or network.

Reproduction

To reproduce this vulnerability, send a GET request to the '/goform/getimage' endpoint of the vulnerable router. The response will contain the router's configuration file, which includes admin credentials. This vulnerability can also be exploited by activating the Telnet service through a similar request to the '/goform/telnet' endpoint.