---
id: "CVE-2020-10987"
kind: "vulnerability"
aliases: ["CVE-2020-10987"]
title: "Tenda AC1900 Router AC15 Model: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.7981
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Tenda AC1900 Router AC15 Model", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Tenda AC15 AC1900 firmware", "fixed": [], "affected": "<= 15.03.05.19", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ac15", "ac1900", "exploited", "infrastructure", "iot", "routers", "self-hosted", "tenda"]
not_affected_if: ["not-ac15", "not-tenda-ac15", "remote-admin-disabled", "web-interface-not-exposed"]
published_at: "2020-07-13T19:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:01:40+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10987", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10987", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10987", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:01:40+00:00"}]
---

# Tenda AC1900 Router AC15 Model: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

Tenda AC15 (AC1900) firmware 15.03.05.19: the goform/setUsbUnload endpoint passes the deviceName POST parameter to a system command, giving root command execution (CWE-78, CVSS 9.8). It is in CISA KEV as exploited. ISE's write-up shows the deviceName request being sent to the web interface with authentication, while NVD scores it as unauthenticated network. Treat the web admin as exposed either way. ISE says Tenda never answered disclosure and had not patched.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tenda AC1900 Router AC15 Model affected ? fixed ?
- vendor:Tenda AC15 AC1900 firmware affected <= 15.03.05.19 fixed ?

## How to check

In the router admin UI (System Status / firmware version) check whether the firmware is V15.03.05.19 or older. Also check that the web admin (port 80) and telnet (23) are not reachable from the internet, e.g. nmap -p 23,80,8180 <WAN IP> from outside.

## Fix

No fixed version is published in any source I read. Mitigate: disable remote/WAN web administration, change the default admin password (default is 'mouse'), keep the LAN admin off untrusted networks, and check Tenda's support site for newer AC15 firmware. Replace the router if Tenda ships no fix.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10987
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-10987
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-10987
- 2026-10-23T21:01:40+00:00 analyst — No Tenda advisory or fixed firmware found; ISE (the discoverer) says Tenda never responded and had not patched. Affected 15.03.05.19 per NVD/ISE; KEV-listed (added 2021-11-03).

## Documents

- [advisory] CISA KEV CVE-2020-10987 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10987
- [describes] ISE: Tenda AC15 AC1900 Vulnerabilities Discovered and Exploited https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
- [mentions] NVD CVE-2020-10987 https://nvd.nist.gov/vuln/detail/CVE-2020-10987

## From the sources

Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_