What is the severity of CVE-2020-26728?

The severity of CVE-2020-26728 is critical with a CVSS score of 9.8.

What is the vulnerability description of CVE-2020-26728?

CVE-2020-26728 is a vulnerability in Tenda AC9 routers that allows for remote code execution via shell metacharacters in the guestuser field.

Which versions of Tenda AC9 firmware are affected by CVE-2020-26728?

Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN are affected by CVE-2020-26728.

How can remote code execution be achieved in CVE-2020-26728?

Remote code execution can be achieved in CVE-2020-26728 by exploiting shell metacharacters in the guestuser field through a POST request.

Are the Tenda AC9 versions 3.0 and 1.0 vulnerable to CVE-2020-26728?

No, Tenda AC9 versions 3.0 and 1.0 are not vulnerable to CVE-2020-26728.

Vulnerability/
CVE-2020-26728

critical

9.8

11/2/2022

4/8/2024

CVE-2020-26728

First published: Fri Feb 11 2022(Updated: )

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Tenda Ac9 Firmware	=15.03.06.42_multi
Tenda AC9	=3.0
Tenda Ac9 Firmware	=15.03.05.19\(6318\)_cn
Tenda AC9	=1.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2020-26728?
The severity of CVE-2020-26728 is critical with a CVSS score of 9.8.
What is the vulnerability description of CVE-2020-26728?
CVE-2020-26728 is a vulnerability in Tenda AC9 routers that allows for remote code execution via shell metacharacters in the guestuser field.
Which versions of Tenda AC9 firmware are affected by CVE-2020-26728?
Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN are affected by CVE-2020-26728.
How can remote code execution be achieved in CVE-2020-26728?
Remote code execution can be achieved in CVE-2020-26728 by exploiting shell metacharacters in the guestuser field through a POST request.
Are the Tenda AC9 versions 3.0 and 1.0 vulnerable to CVE-2020-26728?
No, Tenda AC9 versions 3.0 and 1.0 are not vulnerable to CVE-2020-26728.

agent/type
agent/last-modified-date
agent/first-publish-date
agent/softwarecombine
collector/nvd-index
agent/software-canonical-lookup-request
agent/references
agent/severity
agent/author
agent/tags
agent/description
agent/event
collector/mitre-cve
source/MITRE
vendor/tenda
canonical/tenda ac9 firmware
version/tenda ac9 firmware/15.03.06.42_multi
canonical/tenda ac9
version/tenda ac9/3.0
version/tenda ac9 firmware/15.03.05.19\(6318\)_cn
version/tenda ac9/1.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.