An unauthenticated, critical remote command execution vulnerability exists in Tenda AC1206 firmware version 15.03.06.23 due to a missing authentication check on the manufacturing interface.

The vulnerability resides in the R7WebsSecurityHandler function within the Web UI component, which fails to enforce authentication for the /goform/ate endpoint. An unauthenticated attacker can invoke this endpoint to trigger manufacturing tasks, including system commands such as reboot, factory reset, and NVRAM manipulation, which may lead to full device compromise.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary system commands with the privileges of the web service. Given the CVSS score of 10.0, this represents a total compromise of the affected device, potentially leading to unauthorized network access, data interception, and total loss of device availability. Such an impact is severe for enterprise and home environments relying on the device for secure connectivity.

Immediate Action: Update the Tenda AC1206 firmware to the latest available version provided by the vendor. If an update is not currently available, immediately restrict access to the device management interface from untrusted networks.

Proactive Monitoring: Monitor network traffic for anomalous UDP activity on port 7329, which is the default port opened by the vulnerable manufacturing service. Review system logs for unauthorized configuration changes or unexpected device reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) or network access control list to block unauthorized requests to the /goform/ate endpoint. Ensure that the device administrative interface is not exposed to the public internet.

Public Exploit Available: Yes, a proof of concept and technical documentation are available via the research write-up published on GitHub.

Due to the critical nature of this vulnerability and the availability of public technical details, immediate action is required. Organizations using the Tenda AC1206 should prioritize applying the vendor provided firmware update or implementing strict network segmentation to prevent unauthorized access to the web management interface. Failure to remediate this issue leaves the device susceptible to complete remote takeover.