CVE-2020-26728: Tenda AC9 Firmware

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.

Affected products

• Tenda AC9 Firmware: version 15.03.06.42_multi only; version 15.03.05.19(6318)_cn only

Published 2022-02-11. Last modified 2026-06-17.