An unauthenticated information disclosure vulnerability in Tenda AC6 V5 routers poses a significant risk of sensitive data exposure through the /goform/getproductInfo endpoint.

The vulnerability is categorized as an authentication bypass (CWE-288) that enables unauthenticated network attackers to access sensitive product information by sending specially crafted packets to the web interface.

The exposure of sensitive device information can provide attackers with the reconnaissance data necessary to conduct further, more sophisticated attacks against the network infrastructure. With a CVSS score of 7.5, this high severity flaw could facilitate lateral movement or targeted exploitation of the router, potentially compromising the integrity and privacy of the entire local area network.

Immediate Action: Restrict access to the router web management interface to trusted internal networks or specific administrative management VLANs until a vendor patch is released.

Proactive Monitoring: Monitor network traffic and access logs for unusual requests directed at the /goform/getproductInfo endpoint, which may indicate scanning or exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or similar network security appliance to drop traffic targeting the vulnerable endpoint if the management interface must remain accessible.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this information disclosure vulnerability, administrators should prioritize limiting exposure of the router management interface. While no official patch is currently confirmed, isolating the device from the public internet is a critical step in reducing the attack surface until the vendor provides a formal resolution.