Tenda AC7 Cross-Site Request Forgery Vulnerability in Web Management Interface

A cross-site request forgery (CSRF) vulnerability has been identified in the Tenda AC7 router, affecting firmware versions through V03.03.03.01_cn. The vulnerability arises because the web management interface lacks proper CSRF protections for administrative functions. It does not enforce anti-CSRF tokens or adequate origin validation, potentially allowing an attacker to trick a logged-in administrator into making unintended changes to router settings.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in router configurations by manipulating a logged-in administrator's actions.