Tenda AC18 Samba Configuration Vulnerability Leading to Weak Passwords

A vulnerability exists in the Tenda AC18 router running version 15.03.05.19, specifically within the Samba component. The issue arises from an insecure configuration in the Samba configuration file, /etc_ro/smb.conf, which allows accounts with null passwords to be accessed. This misconfiguration can be exploited remotely, enabling unauthorized access to shared resources without proper authentication. Such access could result in information disclosure or unauthorized manipulation of data.

Impact

Exploitation of this vulnerability could allow remote attackers to gain unauthorized access to accounts with null passwords, potentially leading to unauthorized access to shared resources and associated data.