Live › vulnerability › CVE-2020-10987
Go to dashboardTenda AC15 (AC1900) firmware 15.03.05.19: the goform/setUsbUnload endpoint passes the deviceName POST parameter to a system command, giving root command execution (CWE-78, CVSS 9.8). It is in CISA KEV as exploited. ISE's write-up shows the deviceName request being sent to the web interface with authentication, while NVD scores it as unauthenticated network. Treat the web admin as exposed either way. ISE says Tenda never answered disclosure and had not patched.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Tenda AC1900 Router AC15 Model | vendor | – | – |
| Tenda AC15 AC1900 firmware | vendor | <= 15.03.05.19 | – |
mouse), keep the LAN admin off untrusted networks, and check Tenda's support site for newer AC15 firmwareEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-10987")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.