Tenda FH1202 Improper Access Control Vulnerability in Web Management Interface

A critical vulnerability has been identified in the Tenda FH1202 router, specifically in version 1.2.0.14(408). This vulnerability resides within the web management interface, particularly in the '/goform/AdvSetWrl' file. It involves improper access controls, allowing unauthorized users to manipulate advanced settings of the device. The vulnerability can be exploited remotely without any authentication.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the device's advanced settings, potentially leading to misconfiguration or other security issues.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP POST request to the '/goform/AdvSetWrl' endpoint. The request must be crafted to exploit the improper access control, allowing the attacker to change advanced settings on the device.