CVE-2025-24496 Overview
CVE-2025-24496 is an information disclosure vulnerability in the Tenda AC6 V5.0 router running firmware version V02.03.01.110. The flaw exists in the /goform/getproductInfo endpoint and allows unauthenticated remote attackers to retrieve sensitive device information by sending specially crafted network packets. The vulnerability is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel. Because the endpoint can be reached over the network without credentials, attackers can probe affected devices directly. Exposed information from this endpoint can support reconnaissance and follow-on attacks against the router and the networks it serves.
Critical Impact
Unauthenticated network attackers can extract sensitive product information from Tenda AC6 V5.0 routers by querying /goform/getproductInfo, enabling reconnaissance for further compromise.
Affected Products
- Tenda AC6 hardware revision 5.0
- Tenda AC6 firmware V02.03.01.110
- CPE: cpe:2.3:o:tenda:ac6_firmware:02.03.01.110
Discovery Timeline
- 2025-08-20 - CVE-2025-24496 published to NVD
- 2025-11-03 - Last updated in NVD database
- Reported in Talos Intelligence Vulnerability Report TALOS-2025-2164
Technical Details for CVE-2025-24496
Vulnerability Analysis
The vulnerability resides in the HTTP handler for /goform/getproductInfo on the Tenda AC6 V5.0 router. This endpoint is part of the device's web management interface and processes requests without enforcing proper authentication. When an attacker sends crafted packets to this endpoint, the device responds with sensitive product information that should be restricted to authenticated administrators. The flaw maps to CWE-288, where an alternate request path bypasses the authentication controls that protect other administrative endpoints. The disclosed information can include device identifiers, firmware metadata, and configuration details useful for fingerprinting and targeting follow-on exploits.
Root Cause
The root cause is missing authentication enforcement on the /goform/getproductInfo request handler. The router's web server exposes the endpoint to any network-reachable client and returns product data without verifying session credentials. This design flaw allows the endpoint to act as an alternate channel that circumvents the authentication required by the broader administrative interface.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the router's web management interface sends a crafted HTTP request to /goform/getproductInfo. The device responds with sensitive data in clear text. Exposure is highest when the management interface is reachable from untrusted networks or the internet, but local network attackers on the LAN or guest Wi-Fi can also exploit the issue. Refer to the Talos vulnerability report for the request structure and proof-of-concept details.
Detection Methods for CVE-2025-24496
Indicators of Compromise
- Unauthenticated HTTP requests to /goform/getproductInfo originating from external or unexpected internal sources.
- Outbound responses from the router containing product metadata to clients that have not authenticated to the management interface.
- Reconnaissance scans probing multiple /goform/* endpoints on Tenda AC6 devices.
Detection Strategies
- Inspect web server and firewall logs for HTTP GET or POST requests targeting /goform/getproductInfo on router IP addresses.
- Deploy network IDS signatures that match requests to known Tenda goform endpoints from non-management subnets.
- Correlate access to /goform/getproductInfo with subsequent login attempts or configuration changes to identify reconnaissance preceding exploitation.
Monitoring Recommendations
- Continuously monitor router management interfaces for traffic from WAN-side or guest network sources.
- Alert on any access to administrative endpoints by clients that have not completed an authenticated session.
- Track firmware versions across deployed Tenda AC6 devices to identify systems still running vulnerable builds.
How to Mitigate CVE-2025-24496
Immediate Actions Required
- Restrict access to the router's web management interface so it is reachable only from trusted management hosts on the LAN.
- Disable remote (WAN-side) administration on all Tenda AC6 devices until a patched firmware is available.
- Segment IoT and guest networks from the router management VLAN to limit who can reach /goform/getproductInfo.
Patch Information
At the time of publication, no vendor advisory or patched firmware release is listed in the enriched CVE data. Administrators should monitor the Tenda support portal and the Talos Intelligence Vulnerability Report TALOS-2025-2164 for updates and apply firmware updates as soon as they are published.
Workarounds
- Block inbound traffic to the router's HTTP management port from untrusted networks using an upstream firewall or ACL.
- Place the router behind a network boundary that filters requests to /goform/* paths from non-administrative clients.
- Replace end-of-support Tenda AC6 V5.0 hardware with a supported model that receives regular security updates if a patch is not released.
# Example: restrict router management access to a trusted admin host using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
