This vulnerability affects Tenda AC9 firmware version 15.03.05.14 and is caused by improper authentication handling in the R7WebsSecurityHandler function of the Web Management component. The flaw allows an unauthenticated remote attacker to bypass authentication controls, potentially gaining unauthorized access to the device's management interface. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. Exploit code has been published, increasing the risk of exploitation, although no active exploitation has been confirmed. No official fix or mitigation has been disclosed by Tenda as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass authentication and access the router's web management interface. This could lead to unauthorized configuration changes or control over the device. However, the impact is rated medium due to the lack of confirmed active exploitation and the absence of additional privilege escalation or confidentiality/integrity/availability impacts described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the router's management interface and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently available.