CVE-2020-28094
📋 TL;DR
This CVE describes a supply chain vulnerability in Tenda AC1200 routers where the default speed test configuration points to malicious download servers. The vulnerability allows attackers to deliver malware to router users through what appears to be legitimate router functionality. All users of affected Tenda AC1200 (AC6) routers with vulnerable firmware are at risk.
💻 Affected Systems
- Tenda AC1200 (Model AC6)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deliver persistent malware to all devices on the network, potentially leading to complete network compromise, data exfiltration, and ransomware deployment.
Likely Case
Users downloading router speed test results or related files would receive malware disguised as legitimate software, leading to infected endpoints.
If Mitigated
With proper network segmentation and endpoint protection, malware could be contained to isolated segments and detected before causing significant damage.
🎯 Exploit Status
The exploit requires no authentication and leverages the router's built-in speed test functionality. Attackers would need to control or compromise the referenced download servers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch is documented. Users should upgrade to the latest available firmware from Tenda and verify the speed test configuration points to legitimate servers.
🔧 Temporary Workarounds
Disable Router Speed Test
allPrevent the router from using the vulnerable speed test functionality that connects to malicious servers.
Configure Custom DNS
allUse trusted DNS servers to prevent resolution of malicious domains referenced in the speed test configuration.
🧯 If You Can't Patch
- Replace affected routers with non-vulnerable models from different vendors
- Implement network segmentation to isolate the router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface (typically 192.168.0.1 or 192.168.1.1) and verify if it matches 15.03.06.51_multi.Check Version:
Router web interface → System Status or About pageVerify Fix Applied:
After firmware update, verify the speed test configuration no longer references suspicious domains like those associated with 'elive' or 'CNKI E-Learning' malware.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections from router to unknown domains
- Multiple download attempts for 'elive' or 'CNKI E-Learning' files
Network Indicators:
- DNS queries for suspicious domains associated with the malware
- HTTP traffic to non-Tenda servers during speed tests
SIEM Query:
source="router_logs" AND (destination_domain="*elive*" OR destination_domain="*cnki*" OR file_download="*.exe")