Tenda CP3 Pro Insecure Permissions Vulnerability Allowing Unauthenticated Telnet Access

A vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows insecure permissions that enable the telnet service to be active by default at boot. This is facilitated through the initialization script /etc/init.d/eth.sh. As a result, remote attackers could potentially connect to the device's shell over the network, possibly without authentication, if default or weak credentials are used.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device's shell via the telnet service, allowing for potential manipulation of the device or its settings.