Tenda AC9 Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in the Tenda AC9 router running firmware version 15.03.02.13. This vulnerability allows remote attackers to manipulate the device by sending unauthorized requests, potentially leading to actions such as rebooting the router, which could cause a denial-of-service condition.

Impact

Exploitation of this vulnerability allows for cross-site request forgery, where an attacker can perform actions on behalf of a user without their consent. In this case, it could be used to reboot the device, causing a denial-of-service disruption.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the Tenda AC9 router's firmware version 15.03.02.13. This request must be made in a way that the router believes it is a legitimate request from the user. Once the request is received, the router will perform the action specified in the request, such as rebooting the device.