Authentication Bypass in Tenda AC1206 Web UI

Executive Summary

CVE-2026-82693 is a vulnerability in Tenda AC1206 routers running firmware version US_AC1206V1.0RTL_V15.03.06.23_multi_TD01. It involves a hidden web form route /goform/telnet that allows enabling Telnet without authentication when the device is in a factory-default state. The flaw permits a network-adjacent attacker to start a Telnet daemon via a single HTTP request, bypassing credential requirements.

Useful 0 Not Useful 0

Detection Guidance

• Check if the /goform/telnet endpoint is accessible on the router's web interface without authentication by sending an HTTP GET request to http://<router-ip>/goform/telnet.
• Scan for open Telnet port (typically 23) on the router using tools like nmap: nmap -p 23 <router-ip>.
• Verify if Telnet service is running on the device by checking active services or listening ports.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized remote access to the router via Telnet. Attackers could gain full control over the device, intercept network traffic, install malware, or use the router as a pivot point for further attacks. Since Telnet often lacks encryption, credentials and data transmitted may be exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote access to Tenda AC1206 routers via Telnet, potentially exposing sensitive network traffic and device configurations. This could violate data protection requirements under GDPR and HIPAA by enabling unauthorized interception or manipulation of data in transit.

Useful 0 Not Useful 0

Mitigation Strategies

• Disable Telnet access on the router and switch to SSH for secure remote management.
• Set a strong admin password if not already configured to prevent unauthorized access.
• Update the router's firmware to the latest version that patches this vulnerability.
• Block external access to the router's web interface and management ports from untrusted networks.

Useful 0 Not Useful 0