Tenda AC6 Command Injection Vulnerability in Telnet Handler

A command injection vulnerability has been identified in the Tenda AC6 router, specifically in version 2.0 of the firmware (15.03.06.23). The issue arises in the HTTP daemon (httpd) when the Telnet form is processed. The vulnerability allows remote exploitation by injecting commands through the 'lan.ip' parameter, which is passed to the system command executor without proper sanitization.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/telnet' with a valid session cookie. Include the 'lan.ip' parameter with a crafted value that injects a command, such as 'cat /etc/passwd'.