Summary
CVE-2026-67965 is a critical authentication-bypass vulnerability in the Tenda W20E wireless router (firmware V16.01.0.6(2782)) that allows a remote, unauthenticated attacker to reach the device’s manufacturing/testing (ATE) endpoint and execute arbitrary code on the device. The flaw resides in the url_need_login access-control function, which improperly exempts the /goform/ate (and related /goform/telnet) endpoints from authentication whenever the device’s admin password is unset — the default factory state for many deployed units. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: The
url_need_loginauthorization check, which decides whether an incoming HTTP request to the router’s web management interface requires a valid session, contains logic that skips the login requirement for the/goform/ateand/goform/telnethandlers wheneversys.admin.passwordis empty. - Trigger conditions: The
/goform/ateand/goform/telnethandlers are manufacturing/test artifacts (an "ATE" factory test daemon and a hidden telnet-enabler) that should have been stripped from production firmware but remain reachable in V16.01.0.6(2782). Devices left with no admin password configured (the out-of-box default) are exploitable with no authentication at all. - Attack vector: Network — a single unauthenticated HTTP POST request (e.g.,
POST /goform/ate) is sufficient to activate the manufacturing daemon; a companion request to/goform/telnetcan enable an unauthenticated root telnet/shell session on the device. - Impact: Full compromise of the router — arbitrary command execution with elevated privileges, allowing an attacker to pivot into the internal network, intercept or manipulate traffic, or persist a backdoor on the device. CVSS impact metrics reflect high confidentiality, integrity, and availability loss.
Affected software
- Tenda W20E V5.0, firmware version V16.01.0.6(2782) (build string:
US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin) - Note: this firmware was itself released as a security update for prior W20E command-injection/buffer-overflow issues, but the manufacturing endpoints and the flawed
url_need_loginexemption were not removed in this release.
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Network-exploitable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity, and availability.
Mitigation and recommended actions
- Immediate: No official patched firmware addressing this specific authentication-bypass/manufacturing-endpoint issue has been confirmed at time of writing. Check the Tenda support/download portal for the W20E V5.0 model regularly and apply any firmware update that explicitly removes or disables the
/goform/ateand/goform/telnethandlers as soon as one is released. - Workarounds / network mitigations:
- Immediately set a strong administrator password on the device — the vulnerable code path only bypasses authentication while
sys.admin.passwordis empty. - Do not expose the router’s web management interface (HTTP/HTTPS admin panel) to the WAN or any untrusted network; restrict management access to a trusted internal LAN segment or VPN only.
- Block or firewall inbound access to the device’s management ports from untrusted networks, and monitor for POST requests to
/goform/ateor/goform/telnet. - Where feasible, replace or retire affected W20E units that cannot be updated, given the presence of leftover manufacturing/test functionality in production firmware.
- Immediately set a strong administrator password on the device — the vulnerable code path only bypasses authentication while

