CVE-2020-26728

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.

• https://github.com/Lyc-heng/Router/blob/main/Tenda/rce1.mdBroken Link
• https://github.com/Lyc-heng/routers/blob/a80b30bccfc9b76f3a4868ff28ad5ce2e0fca180/routers/rce1.mdExploit, Third Party Advisory
• https://github.com/Lyc-heng/routers/blob/main/routers/rce1.mdExploit, Third Party Advisory
• https://github.com/Lyc-heng/Router/blob/main/Tenda/rce1.mdBroken Link
• https://github.com/Lyc-heng/routers/blob/a80b30bccfc9b76f3a4868ff28ad5ce2e0fca180/routers/rce1.mdExploit, Third Party Advisory
• https://github.com/Lyc-heng/routers/blob/main/routers/rce1.mdExploit, Third Party Advisory

Published

Feb 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26709py-xml v1.0 was discovered to contain an XML External Entity…7.5
• CVE-2020-2671Vulnerability in the Oracle Email Center product of Oracle E…8.2
• CVE-2020-26710easy-parse v0.1.1 was discovered to contain a XML External E…7.5
• CVE-2020-26712REDCap 10.3.4 contains a SQL injection vulnerability in the …9.8
• CVE-2020-26713REDCap 10.3.4 contains a XSS vulnerability in the ToDoList f…6.1
• CVE-2020-2672Vulnerability in the Oracle Email Center product of Oracle E…8.2
• CVE-2020-2673Vulnerability in the Oracle Application Testing Suite produc…7.5
• CVE-2020-26732SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2…7.5
• CVE-2020-26733Cross Site Scripting (XSS) in Configuration page in SKYWORTH…5.4
• CVE-2020-2674Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
• CVE-2020-2675Vulnerability in the Oracle Hospitality OPERA 5 product of O…7.1
• CVE-2020-26759clickhouse-driver before 0.1.5 allows a malicious clickhouse…9.8