Tenda FH1202 Web Management Interface Improper Access Control Vulnerability

A critical vulnerability has been identified in the Tenda FH1202 router, specifically in version 1.2.0.14(408). The issue resides within the Web Management Interface, particularly in the file '/goform/AdvSetWrlsafeset'. This vulnerability allows for improper access controls, enabling unauthorized users to manipulate certain settings. The flaw can be exploited remotely without authentication.

Impact

Exploitation of this vulnerability allows for improper access control, where the device's safe settings can be altered by an unauthorized actor.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP POST request to the '/goform/AdvSetWrlsafeset' endpoint. This request can be crafted to manipulate the safe settings of the Tenda FH1202 router.