Tenda AC1206 Command Injection Vulnerability

A command injection vulnerability exists in the Tenda AC1206 router running firmware version 15.03.06.23. The issue arises in the HTTP component, specifically within the 'formBehaviorManager' function of the '/goform/BehaviorManager' file. The vulnerability allows remote attackers to inject commands by manipulating the 'modulename', 'option', 'data', and 'switch' parameters. The 'data' parameter is particularly vulnerable, as it is executed without proper sanitization, leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/BehaviorManager' endpoint with the 'modulename', 'option', 'switch', and 'data' parameters. The 'data' parameter can be crafted to include malicious commands, such as a command to create a file on the device.