CVE-2020-10987

This is a flaw in a router’s web feature that lets an attacker “talk to the router” over the internet. If your device uses the specific firmware version, a malicious request can trick the router into running commands on its own—like handing over a remote control that can be used to disrupt your business network or spy on connected devices.

This matters if your business uses a Tenda AC15 AC1900 router running firmware 15.03.05.19 and the endpoint /goform/setUsbUnload is reachable. Because the flaw does not require authentication and is reachable in the default configuration, exposure is especially likely on typical setups where the router’s web interface is accessible from the network. The risk is highest when an attacker can reach that endpoint over the network (for example, from the internet).

This is RED because confirmed real-world attention has been captured in CISA’s KEV and it enables unauthenticated remote command execution. Attackers only need network reachability to trigger the flaw—no login and no user action are required. Treat it as an immediate patching priority for any affected firmware you still run.

1. Identify affected devices

   • Log into the Tenda AC15 AC1900 and note the firmware version.
   • Confirm it is exactly 15.03.05.19.
   • Confirm whether /goform/setUsbUnload is reachable from outside your local network (or from the internet).

2. Check for signs of attempted abuse

   • Review router logs (web access and system logs) for requests targeting /goform/setUsbUnload.
   • Look for unusual reboots, unexpected configuration changes, new users, or sudden connectivity changes.

3. Upgrade to the vendor-fixed firmware

   • Use the official vendor firmware update instructions provided for Tenda AC15 AC1900.
   • Apply the update immediately; CVE-2020-10987 is listed in CISA KEV, with a CISA remediation due date of 2022-05-03.
   • After upgrading, verify the router is no longer on 15.03.05.19.

4. Interim mitigation if patching must wait

   • Restrict management interface access to your internal network (or a VPN) only.
   • Block WAN/internet-originated access to router web endpoints at the firewall (deny inbound connections to the router’s web management ports).
   • Ensure no port-forwarding rules expose the router’s web management functionality to the internet.

5. Monitor after remediation

   • Continue checking logs for any further attempts to access /goform/setUsbUnload.
   • If there were suspicious requests prior to patching, consider also scanning/inspecting other devices on your network for signs of compromise and ensure router configuration is restored to a known-good state.

Severity: Critical, with remote command execution (CWE-78) allowing arbitrary system command execution.

Mechanism and trigger: In Tenda AC15 AC1900 firmware 15.03.05.19, the /goform/setUsbUnload endpoint processes a POST parameter (deviceName) in a way that lets an attacker run arbitrary commands on the device without authentication. The endpoint is reachable in the default configuration.

Exploitation status: CISA KEV lists this vulnerability as applicable, indicating it has been observed in the wild. This elevates the practical risk beyond proof-of-concept.

Exploit availability: A public exploit is available (1 known), which lowers the barrier for attackers.

Exposure prerequisites from findings: the target must be running the specific firmware 15.03.05.19 and the endpoint /goform/setUsbUnload must be reachable over the network.

EPSS note: A very high EPSS prediction is reported, but KEV confirmation is the deciding factor for urgency and has priority in practice.