No CSRF token validation exists on this endpoint. Using strings on the squashfs root, we discovered:
An authenticated attacker (or any user on the LAN if the session check is bypassed) can inject arbitrary commands via the ping diagnostic tool. Example: Tenda Mx12 Firmware
Disclosure timeline: Reported to Tenda Security (security@tenda.com.cn) on Jan 12, 2026 – no acknowledgment as of April 17, 2026. No CSRF token validation exists on this endpoint
In the crowded market of affordable WiFi 6 mesh systems, the Tenda MX12 (often bundled as the "Nova" series) is a bestseller on Amazon and AliExpress. Priced aggressively against the Eero 6 and Deco X20, it promises AX3000 speeds and seamless roaming. Tenda Mx12 Firmware