Tenda AC8, AC10, and AC18 Command Injection Vulnerability via Telnet HTTP Request

A critical command injection vulnerability has been identified in Tenda AC8, AC10, and AC18 routers running firmware version 16.03.10.20. The issue arises in the HTTP request handler for the '/goform/telnet' route, where an unknown functionality allows for the execution of arbitrary commands. This vulnerability can be exploited remotely, but requires authentication as an admin user.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/telnet' endpoint. Include a cookie with the 'user' set to 'admin'. The request can be made using HTTP/0.9.