CVE-2020-28095: Tenda AC6 Firmware

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop.

Affected products

• Tenda AC6 Firmware: version 15.03.06.51 only

Published 2020-12-30. Last modified 2026-06-17.