Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

CRITICO 9.8EXPLOITED (CISA KEV)CVE-2020-10987 · Published 13/07/2020 · updated 17/06/2026

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In breve

CVE-2020-10987 è una vulnerabilità CRITICO (CVSS 9.8).
Sfruttata attivamente: la CISA l'ha aggiunta al catalogo KEV il 03/11/2021.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 79.8%, superiore al 99.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
AC1900 Router AC15 Model Tenda	Versions not published yet (product named by CISA KEV)

Description

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

References

blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68 · Exploit
ise.io/research · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-10987

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free