PT-2020-16926 · Tenda · Tenda Ac1200

Published 2020-12-29 · Updated 2025-07-07 · CVE-2020-28095

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC1200 (Model AC6) version 15.03.06.51 multi

Description A large HTTP POST request sent to the "change password API" will trigger the router to crash and enter an infinite boot loop.

Recommendations For Tenda AC1200 (Model AC6) version 15.03.06.51 multi, as a temporary workaround, consider restricting access to the change password API until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2025-11315

CVE-2020-28095

Affected Products

Tenda Ac1200

References · 7

• 🔥 https://github.com/cecada/Tenda-AC6-Root-Acces/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-28095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28095 · Security Note
• https://bdu.fstec.ru/vul/2025-11315 · Security Note
• https://t.me/cibsecurity/21434 · Telegram Post
• https://t.me/cvenotify/7990 · Telegram Post
• https://t.me/cvenotify/127876 · Telegram Post