important · Wi-Fi
An unauthenticated LAN client can replace a Tenda AC9 administrator password persistently.
Affects
Tenda AC9, an embedded dual-band Wi-Fi router.
An authentication-exempt prefix exposes fast_setting_wifi_set, which writes the supplied password into sys.userpass and commits it to flash.
Detail and 1 source
The attacker needs LAN or Wi-Fi access to TCP port 8080 but no session or current password.