Tenda i12 Path Traversal Vulnerability Allowing Whitelist Bypass

A critical path traversal vulnerability has been identified in the Tenda i12 router, specifically in version 1.0.0.11(3862). The issue arises within the HTTP Handler component, where the R7WebsSecurityHandler function improperly validates URL paths. This flaw allows unauthenticated remote attackers to exploit directory traversal sequences to access sensitive files, bypassing authentication and potentially leading to unauthorized administrative access.

Impact

Exploitation of this vulnerability allows for unauthenticated access to sensitive resources and administrative interfaces on the affected router.

Reproduction

To reproduce this vulnerability, send an HTTP GET request to the router's IP address, targeting a URL that begins with a whitelisted prefix, such as '/public/'. Include directory traversal sequences, like '../', to escape the restricted directory and access sensitive files, such as 'system_upgrade.asp'.