Details of VAR-202012-0812

ID

VAR-202012-0812

CVE

CVE-2020-28095

TITLE

Tenda AC1200 Infinite loop vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-015074

DESCRIPTION

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop. Tenda AC1200 (Model AC6) Exists in an infinite loop vulnerability.Denial of service (DoS) It may be put into a state. Tenda AC6 is an AC1200 smart dual-band WiFi router. Tenda AC6 15.03.06.51_multi has a denial of service vulnerability

Trust: 2.16

sources: NVD: CVE-2020-28095 // JVNDB: JVNDB-2020-015074 // CNVD: CNVD-2021-01060

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-01060

AFFECTED PRODUCTS

vendor:	tenda	model:	ac1200	scope:	eq	version:	15.03.06.51_multi	Trust: 1.0
vendor:	tenda	model:	ac1200	scope:	eq	version:	ac1200 firmware 15.03.06.51	Trust: 0.8
vendor:	tenda	model:	ac1200	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	ac6 15.03.06.51 multi	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2021-01060 // JVNDB: JVNDB-2020-015074 // NVD: CVE-2020-28095

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-28095
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-28095
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2021-01060
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202012-1807
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-28095
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2021-01060
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-28095
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-28095
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-01060 // JVNDB: JVNDB-2020-015074 // CNNVD: CNNVD-202012-1807 // NVD: CVE-2020-28095

PROBLEMTYPE DATA

problemtype:	CWE-835	Trust: 1.0
problemtype:	infinite loop (CWE-835) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-015074 // NVD: CVE-2020-28095

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-1807

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202012-1807

PATCH

title:	Top Page	url:	https://www.tendacn.com/default.html	Trust: 0.8
title:	Tenda AC1200 Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138175	Trust: 0.6

sources: JVNDB: JVNDB-2020-015074 // CNNVD: CNNVD-202012-1807

EXTERNAL IDS

db:	NVD	id:	CVE-2020-28095	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-015074	Trust: 0.8
db:	CNVD	id:	CNVD-2021-01060	Trust: 0.6
db:	CNNVD	id:	CNNVD-202012-1807	Trust: 0.6

sources: CNVD: CNVD-2021-01060 // JVNDB: JVNDB-2020-015074 // CNNVD: CNNVD-202012-1807 // NVD: CVE-2020-28095

REFERENCES

url:	https://github.com/cecada/tenda-ac6-root-acces/blob/main/readme.md	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2020-28095	Trust: 2.0

sources: CNVD: CNVD-2021-01060 // JVNDB: JVNDB-2020-015074 // CNNVD: CNNVD-202012-1807 // NVD: CVE-2020-28095

SOURCES

db:	CNVD	id:	CNVD-2021-01060
db:	JVNDB	id:	JVNDB-2020-015074
db:	CNNVD	id:	CNNVD-202012-1807
db:	NVD	id:	CVE-2020-28095

LAST UPDATE DATE

2024-11-23T21:35:02.100000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-01060	date:	2021-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-015074	date:	2021-09-09T08:51:00
db:	CNNVD	id:	CNNVD-202012-1807	date:	2021-01-12T00:00:00
db:	NVD	id:	CVE-2020-28095	date:	2024-11-21T05:22:21.310

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-01060	date:	2021-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-015074	date:	2021-09-09T00:00:00
db:	CNNVD	id:	CNNVD-202012-1807	date:	2020-12-30T00:00:00
db:	NVD	id:	CVE-2020-28095	date:	2020-12-30T21:15:12.797