A critical authentication bypass vulnerability in Tenda AC1206 routers allows unauthenticated attackers to enable the Telnet service, posing a severe risk of full device compromise.

The vulnerability exists within the TendaTelnet function of the Web UI, which is reachable via the /goform/telnet file. When the router is in a factory-default state without a configured administrator password, an unauthenticated attacker can trigger this endpoint to enable and start the Telnet daemon.

Successful exploitation allows an attacker to enable a management service that should not be exposed, significantly expanding the device attack surface. By gaining access to the Telnet interface, an attacker may be able to execute arbitrary commands, bypass further security controls, or gain persistent control over the network infrastructure. Given the CVSS score of 10.0, this represents a critical risk that could lead to complete loss of confidentiality, integrity, and availability for the affected network device.

Immediate Action: There is currently no vendor-provided patch for this specific issue; administrators should immediately secure the device by setting a strong, non-default administrator password to prevent the default-state condition that permits this exploit.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts to the management interface, specifically looking for GET requests to the /goform/telnet endpoint. Review system logs for unexpected initialization of the Telnet daemon.

Compensating Controls: Restrict access to the router Web UI to trusted management IP addresses only and ensure the device is not exposed to the public internet. If possible, disable Telnet at the firmware level if it is not required for operational purposes.

Public Exploit Available: Yes, a technical write-up containing the attack methodology and proof-of-concept details is available via the linked research documentation.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized Telnet access. Because no official patch is currently available, administrators must prioritize hardening their device configuration by enforcing strong authentication immediately. Failure to secure the management interface creates a trivial path for attackers to gain administrative control over the network gateway.