CVEvulnerability

CVE-2020-10987

9.8 CRITICAL Known exploited Published 2020-07-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability — Tenda AC1900 Router AC15 Model

Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-10987
Status
Analyzed
Published
2020-07-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-78

Description

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

Affected configurations

• tenda ac15 firmware 15.03.05.19

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

Referenced by CWE · observed example (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References