An unauthenticated remote code execution vulnerability in Tenda AC9 routers allows attackers to hijack administrative access by resetting the device password.

The vulnerability exists in the R7WebsSecurityHandler component, which incorrectly whitelists the /goform/fast_setting URL prefix, allowing requests to bypass all authentication checks. An attacker can send a crafted HTTP POST request to the /goform/fast_setting_wifi_set endpoint to overwrite the administrative password, granting them full control over the router.

Successful exploitation results in a complete compromise of the network device, allowing attackers to intercept traffic, modify DNS settings, or pivot into the internal network. Given the CVSS score of 7.3, this represents a significant risk to organizational integrity and data privacy, as the router serves as the primary gateway for network communications.

Immediate Action: Update the Tenda AC9 firmware to a version beyond 15.03.05.16 immediately, or if no patch is available, disable remote web management access.

Proactive Monitoring: Review device access logs for frequent or unauthorized POST requests to the /goform/fast_setting_wifi_set endpoint and monitor for unexpected changes to administrative credentials.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge firewall rule to block all external access to the /goform/ directory on the router until the firmware is successfully patched.

Public Exploit Available: Yes, a technical write-up detailing the exploit mechanism and a functional Proof of Concept (PoC) request is available via the researcher's GitHub repository.

This vulnerability presents a severe risk to network security by allowing unauthorized administrative access. Organizations utilizing Tenda AC9 routers must prioritize firmware updates or implement strict network access controls to prevent external access to the management interface. Immediate action is required to eliminate the possibility of remote exploitation.