Tenda AC20 Hard-Coded Credentials Vulnerability

A hard-coded credentials vulnerability exists in the Tenda AC20 router running firmware version 16.03.08.12. The root user's password is hard-coded and stored in the '/etc_ro/shadow' file as an MD5-crypt hash. This vulnerability allows attackers to crack the password hash using password-cracking tools, such as John the Ripper, and gain unauthorized root access to the router. The vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability allows for unauthorized access to the router's system with root privileges.

Reproduction

The vulnerability can be reproduced by extracting the router's firmware file and analyzing the '/etc_ro/shadow' file. The root password hash can be found in this file, which can then be cracked using a password-cracking tool to obtain the plaintext password.