Tenda W18E Incorrect Access Control Vulnerability Allowing Unauthorized WiFi and Admin Credential Changes

An incorrect access control vulnerability has been identified in the Tenda W18E router, specifically in version V16.01.0.8(1625). The issue allows attackers to send specially crafted HTTP POST requests to the setQuickCfgWifiAndLogin function. This exploitation can lead to unauthorized modifications of WiFi configuration settings and administrative credentials.

Impact

Exploitation of this vulnerability could result in unauthorized access to the router's administrative interface and the ability to change WiFi settings, potentially allowing for unauthorized network access.