{"id":"CVE-2020-10987","kind":"vulnerability","aliases":["CVE-2020-10987"],"related":[],"title":"Tenda AC1900 Router AC15 Model: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability","description":"Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Tenda AC15 (AC1900) firmware 15.03.05.19: the goform/setUsbUnload endpoint passes the deviceName POST parameter to a system command, giving root command execution (CWE-78, CVSS 9.8). It is in CISA KEV as exploited. ISE's write-up shows the deviceName request being sent to the web interface with authentication, while NVD scores it as unauthenticated network. Treat the web admin as exposed either way. ISE says Tenda never answered disclosure and had not patched.","severity":"critical","cvss":10.0,"epss":0.7981,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Tenda AC1900 Router AC15 Model","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Tenda AC15 AC1900 firmware","fixed":[],"affected":"<= 15.03.05.19","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ac15","ac1900","exploited","infrastructure","iot","routers","self-hosted","tenda"],"not_affected_if":["not-ac15","not-tenda-ac15","remote-admin-disabled","web-interface-not-exposed"],"how_to_check":"In the router admin UI (System Status / firmware version) check whether the firmware is V15.03.05.19 or older. Also check that the web admin (port 80) and telnet (23) are not reachable from the internet, e.g. nmap -p 23,80,8180 <WAN IP> from outside.","fix":"No fixed version is published in any source I read. Mitigate: disable remote/WAN web administration, change the default admin password (default is 'mouse'), keep the LAN admin off untrusted networks, and check Tenda's support site for newer AC15 firmware. Replace the router if Tenda ships no fix.","status":"open","published_at":"2020-07-13T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:27+00:00","updated_at":"2026-10-23T21:01:40+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:29:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update per Tenda instructions; the sources do not name a fixed version.","summary":"The Tenda AC1900 AC15 router has a flaw in which the deviceName POST parameter lets a remote attacker run system commands on the device. An attacker who reaches the router's web interface gets command execution on the router, which can expose the local network.","category":"infrastructure","who_cares":["tenda","ac1900","ac15","routers","self-hosted"],"confidence":0.8,"analyst_note":"Find the fixed firmware version and the Tenda advisory for CVE-2020-10987; the CISA KEV entry is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10987.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-tenda-ac15","web-interface-not-exposed"],"severity_if_unknown":"critical"},"cost_usd":0.00038,"input_tokens":2128,"output_tokens":335,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed firmware version and the Tenda advisory for CVE-2020-10987; the CISA KEV entry is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10987.","search":"'-10987':17A,20A '-2020':16A,19A '-78':62B '15.03.05.19':44B '9.8':64B 'ac15':4A,9A,24A,27A,30B,41B,117C 'ac1900':2A,7A,22A,28A,31B,42B,115C 'action':138C 'admin':99B 'allow':124C 'answer':108B 'appli':139C 'attack':126C 'authent':88B 'cisa':68B,136C 'code':12A 'command':56B,59B,130C 'contain':119C 'cve':15A,18A 'cvss':63B 'cwe':61B 'devicenam':50B,79B,133C 'disclosur':109B 'either':102B 'endpoint':47B 'execut':13A,60B,128C 'exploit':32B,71B 'expos':101B 'firmwar':43B 'firmware':29A 'give':57B 'goform/setusbunload':46B 'host':38B 'infrastructur':33B 'instruct':143C 'interfac':86B 'iot':34B 'ise':72B,104B 'kev':69B 'model':5A,10A,25A,118C 'network':95B 'never':107B 'nvd':90B 'paramet':52B,135C 'pass':48B 'patch':113B 'per':141C 'post':51B,134C 'remot':11A,125C 'request':80B 'requir':137C 'root':58B 'router':3A,8A,23A,35B,116C 'say':105B 'score':91B 'self':37B 'self-host':36B 'sent':82B 'show':77B 'system':55B,129C 'tenda':1A,6A,21A,26A,39B,40B,106B,114C 'treat':96B 'unauthent':94B 'unspecifi':121C 'updat':140C 'vendor':142C 'via':131C 'vulner':14A,122C 'way':103B 'web':85B,98B 'write':75B 'write-up':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-13T19:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-10987","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10987","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2020-10987","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10987","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-10987","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10987","severity":null,"published_at":"2020-07-13T19:15:12+00:00","modified_at":"2026-06-17T02:48:48+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2020-10987:36","url":null,"severity":null,"published_at":"2026-10-23T21:01:40+00:00","modified_at":"2026-10-23T21:01:40+00:00","first_seen_at":"2026-10-23T21:01:40+00:00","fetched_at":"2026-10-23T21:01:40+00:00","note":"No Tenda advisory or fixed firmware found; ISE (the discoverer) says Tenda never responded and had not patched. Affected 15.03.05.19 per NVD/ISE; KEV-listed (added 2021-11-03)."}],"documents":[{"id":893,"url":"https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68","title":"ISE: Tenda AC15 AC1900 Vulnerabilities Discovered and Exploited","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":894,"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10987","title":"NVD CVE-2020-10987","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":895,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10987","title":"CISA KEV CVE-2020-10987","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}