CVE-2020-10987
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
Description
CVE-2020-10987 is a critical-severity OS command injection vulnerability in the Tenda AC15 AC1900 router. The goform/setUsbUnload endpoint allows remote, unauthenticated attackers to execute arbitrary system commands via the deviceName POST parameter. This command injection vulnerability affects Tenda AC15 firmware version 15.03.05.19 and allows complete device takeover. CISA has confirmed active exploitation by adding CVE-2020-10987 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tenda | ac15 firmware | 15.03.05.19 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68(Exploit, Third Party Advisory)
- https://www.ise.io/research/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10987(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
OS Command Injection occurs when software constructs OS commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2020-10987, the Tenda AC15 router’s goform/setUsbUnload endpoint passes the deviceName POST parameter directly to system command execution functions without sanitization, allowing attackers to inject and execute arbitrary operating system commands.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2020-10987 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any attacker who can reach the device’s web interface. Confidentiality (High): Arbitrary command execution grants access to all data on the device, including stored credentials, network configurations, and traffic passing through the router. Integrity (High): Attackers can modify firmware, alter routing rules, inject malicious DNS entries, or install persistent backdoors. Availability (High): Complete denial of service is possible by disrupting the router’s operation or resetting the device. With an EPSS score of 93.6% (99.8th percentile), this vulnerability is among the most actively targeted in the entire CVE database.
Exploit Maturity
CVE-2020-10987 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit information is available via a detailed security research writeup that documents the exploitation methodology. The EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most targeted across all known CVEs. IoT botnets are known to actively scan for and exploit command injection vulnerabilities in consumer routers like the Tenda AC15. Federal agencies were required to remediate by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply firmware updates immediately as required by CISA KEV: Apply updates per vendor instructions. Update Tenda AC15 devices to a firmware version that addresses the command injection in the goform/setUsbUnload endpoint.
- Disable remote management access: Ensure the router’s web management interface is not exposed to the internet. Disable WAN-side management access and restrict the goform/setUsbUnload endpoint to trusted internal networks only.
- Implement network-level filtering: Deploy firewall or ACL rules to block external access to the router’s management ports (typically HTTP/HTTPS on ports 80/443). Consider placing the router behind a separate firewall with strict ingress rules.
- Monitor for signs of compromise: Check the router for unauthorized firmware modifications, unexpected DNS configuration changes, unusual outbound traffic patterns, or connections to known command-and-control infrastructure.
- Evaluate device replacement: If the vendor has not released a firmware patch, consider replacing the Tenda AC15 with a router from a manufacturer that provides regular security updates and input validation for all management endpoints.
Technical Details
CVE-2020-10987 is an OS command injection vulnerability in the goform/setUsbUnload endpoint of the Tenda AC15 AC1900 router running firmware version 15.03.05.19. The vulnerable code takes the deviceName parameter from a POST request and passes it directly to a system command execution function without any input sanitization or validation, constituting an Improper Neutralization of Special Elements used in an OS Command (CWE-78). The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires no authentication or user interaction, and has low complexity. An attacker can inject shell metacharacters such as semicolons, pipes, or command substitution sequences into the deviceName parameter to execute arbitrary commands with root privileges on the underlying Linux operating system, achieving complete control over the device.
Frequently Asked Questions
Is CVE-2020-10987 being actively exploited?
Yes. CVE-2020-10987 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation, and detailed security research documenting the exploitation methodology is publicly available.
What products are affected by CVE-2020-10987?
CVE-2020-10987 affects the Tenda AC15 AC1900 router running firmware version 15.03.05.19. The vulnerability is in the goform/setUsbUnload endpoint, specifically in the handling of the deviceName POST parameter.
How do I fix CVE-2020-10987?
Update the Tenda AC15 to the latest firmware from the vendor. If no patch is available, disable remote management access, restrict access to the management interface from the internet, and consider replacing the device with one that receives regular security updates.
How severe is CVE-2020-10987?
CVE-2020-10987 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity classification. The vulnerability allows unauthenticated remote command execution with no user interaction, giving attackers complete control over the affected device.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.