ZeroDay Findings
Sign inSign up

Findings

CVE-2020-10987

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

Published Jul 13, 2020 · updated Jun 16, 2026 · tenda ac15 firmware

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 13, 2020 · Catalog

    Detected

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe tenda/ac15 firmware15.03.05.19
  • vendor Tenda AC1900 Router AC15 Modelversion unspecified

Sources

  • CISA KEVCVE-2020-10987

    Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

    cisa.gov
  • CVE.orgCVE-2020-10987

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-10987

    30-day exploitation probability 79.8%

    first.org
  • NIST NVDCVE-2020-10987

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

    nvd.nist.gov

References