CVE-2020-10987: Tenda AC15 router command injection in goform/setUsbUnload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in CISA KEV, and a very high EPSS score make this an urgent patch-or-replace item.

What it is

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 firmware 15.03.05.19 passes the deviceName POST parameter to a system command without sanitization, allowing OS command injection. Because the endpoint is reachable over the network with no credentials, any host that can reach the router's web interface can run arbitrary commands as the device's system user.

Impact

An attacker gains arbitrary command execution on the router, enabling full device compromise, credential and configuration theft, and use of the device as a pivot into the internal network.

Attack surface

Reached over the network via HTTP POST to the goform/setUsbUnload endpoint; the CVSS vector shows no privileges and no user interaction required, so the request can be sent directly to the router's management interface.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS gives a 30-day exploitation probability of 0.7981 (99.6th percentile); references are tagged Exploit, indicating public exploit code exists. No ransomware campaign use is documented.

What to do

• Apply the vendor firmware update for Tenda AC15 AC1900 per CISA's required action; if no fixed firmware is available, replace the device.
• Restrict access to the router's web management interface to trusted management networks only; never expose it to the internet.
• Disable remote management and UPnP/WAN-side administration features where the firmware allows it.
• Segment IoT and router management traffic from production networks to limit lateral movement if the device is compromised.
• Monitor vendor and CISA advisories for this product line since the affected firmware version is explicitly named.

Detection

• Alert on HTTP POST requests to /goform/setUsbUnload, especially with shell metacharacters (;, |, $(), backticks) in the deviceName parameter.
• Monitor router and network logs for unexpected outbound connections or command-and-control traffic originating from the router's management IP.
• Baseline and alert on configuration changes or new processes on the router that do not match normal administrative activity.
• Watch for scanning or repeated requests to the goform endpoints from untrusted source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.