CVE-2020-28095 : What You Need to Know

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop.

Understanding CVE-2020-28095

This CVE involves a vulnerability in Tenda AC1200 (Model AC6) routers that can be exploited by sending a specific type of HTTP POST request.

What is CVE-2020-28095?

The vulnerability in Tenda AC1200 (Model AC6) routers allows attackers to crash the device and cause it to enter a continuous reboot cycle by sending a particular HTTP POST request to the change password API.

The Impact of CVE-2020-28095

Exploiting this vulnerability can lead to a denial of service (DoS) condition on the affected router, rendering it inoperable until the issue is resolved.

Technical Details of CVE-2020-28095

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The vulnerability in Tenda AC1200 (Model AC6) routers is triggered by a large HTTP POST request to the change password API, causing the device to crash and enter a boot loop.

Affected Systems and Versions

Product: Tenda AC1200 (Model AC6)
Version: 15.03.06.51_multi

Exploitation Mechanism

Attackers exploit this vulnerability by sending a specific HTTP POST request to the change password API, triggering the router to crash and continuously reboot.

Mitigation and Prevention

Protecting systems from CVE-2020-28095 requires immediate action and long-term security measures.

Immediate Steps to Take

Disable remote management access to the router if not needed.
Implement firewall rules to restrict access to the router's administration interface.
Regularly monitor network traffic for any suspicious activity.

Long-Term Security Practices

Keep router firmware up to date with the latest security patches.
Change default passwords and use strong, unique passwords for router access.
Conduct regular security audits and penetration testing to identify and address vulnerabilities.

Patching and Updates

Ensure that the Tenda AC1200 (Model AC6) router is updated with the latest firmware that addresses the vulnerability.