Hacking a Tenda AC1200 Wi-Fi Router with a CVE Combo

A security researcher preparing to document a known backdoor in a Tenda router bought the wrong model—the AC10V6. Undeterred, they set out to find exploits in it anyway. Per Hackaday, they discovered encrypted firmware wasn't enough to stop a determined attacker. The researcher chained together multiple Tenda vulnerabilities: a Telnet exploit from another model and a password-derivation flaw using the device's MAC address. The derivation required a static string unknown for this model, so they opened the router, probed the UART debug pins, and found Tenda had printed the secret password directly to serial output. Armed with that, they gained root access and recovered the firmware decryption keys. The incident is a cascade of security failures, from secrets printed to debug ports to multiple exploitable CVEs.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton