{"id":"CVE-2020-10987","published":"2020-07-13T19:15:12Z","modified":"2026-06-17T02:48:48Z","title":"Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability","vendor":"Tenda","product":"AC1900 Router AC15 Model","tier":"core","eol":null,"description":{"text":"The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an OS command injection in the goform/setUsbUnload endpoint of the Tenda AC1900 Router AC15 Model, specifically in its handling of the deviceName POST parameter. An unauthenticated remote attacker with network access can execute arbitrary system commands on the device by sending a crafted request, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.7981,"percentile":0.99607,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-10987","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-11-06","exploitedFirstSeen":"2020-11-06","ransomware":false,"evidence":[{"url":"https://www.bleepingcomputer.com/news/security/reverse-shell-botnet-gitpaste-12-spreads-via-github-and-pastebin/#google_vignette","date":"2020-11-06"},{"url":"https://blogs.juniper.net/en-us/threat-research/everything-but-the-kitchen-sink-more-attacks-from-the-gitpaste-12-worm","date":"2020-12-14"},{"url":"https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b","date":"2021-04-13"},{"url":"https://cybersecurity.att.com/blogs/labs-research/malware-hosting-domain-cyberium-fanning-out-mirai-variants","date":"2021-06-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits","date":"2021-11-11"},{"url":"https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github","date":"2022-01-26"},{"url":"https://mp.weixin.qq.com/s/z7lnj0PYjL6TRqhFVYS9oQ","date":"2022-01-26"},{"url":"https://www.fortiguard.com/threat-signal-report/4389/botenago-malware-targets-multiple-iot-devices","date":"2022-01-27"},{"url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","date":"2022-12-06"}],"evidenceTotal":24,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.ise.io/research/","tags":["Third Party Advisory"]},{"url":"https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.ise.io/research/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10987","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of exposed web endpoint","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers","start":4,"end":97}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary OS command execution via POST parameter","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary system commands via the deviceName POST parameter","start":74,"end":168}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"CVE-2020-10987","start":12075,"end":12089}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-3386","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3386","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-10-23","earliestUrl":"https://github.com/Jaden-Bowers/Tenda-Router-VR-and-Exploit","repos":[{"name":"Jaden-Bowers/Tenda-Router-VR-and-Exploit","url":"https://github.com/Jaden-Bowers/Tenda-Router-VR-and-Exploit","stars":0,"created":"2025-10-23"}]},"nuclei":[{"id":"CVE-2020-10987","name":"Tenda AC15 AC1900 version 15.03.05.19 - Command Injection","severity":"critical","path":"http/cves/2020/CVE-2020-10987.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10987.yaml"}],"first":{"date":"2025-10-23","source":"PoC-in-GitHub","url":"https://github.com/Jaden-Bowers/Tenda-Router-VR-and-Exploit"},"provenance":"source"},"exploitRefs":["https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-07-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10987","provenance":"source"},{"date":"2020-11-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.bleepingcomputer.com/news/security/reverse-shell-botnet-gitpaste-12-spreads-via-github-and-pastebin/#google_vignette","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3386","provenance":"source"},{"date":"2025-10-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Jaden-Bowers/Tenda-Router-VR-and-Exploit","provenance":"source"}],"speed":{"daysToPublicExploit":1928,"firstExploitFrom":"PoC-in-GitHub","daysToKev":478},"priority":{"score":73.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2183 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}