Tenda AC6 Unsafe Default Authentication Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in the Tenda AC6 router, specifically in version 5.0 V02.03.01.110, due to an unsafe default authentication process during the initial setup. The setup wizard fails to require a web portal username and password, allowing anyone on the local network to gain full administrative access without authentication. This oversight can be exploited to execute arbitrary code, including the installation of malicious firmware.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the affected device.