Tenda AC15 - RCE (CVE-2020-10987)

CVE-2020-10987 is a critical vulnerability in the Tenda AC15 AC1900 router that allows remote attackers to execute arbitrary system commands through the deviceName POST parameter at the goform/setUsbUnload endpoint. This flaw can be exploited to gain full control over the device, potentially leading to data theft, network compromise, or further attacks within the affected network environment.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-10987 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /goform/setUsbUnload endpoint by sending crafted POST requests where the deviceName parameter contains injected system commands, enabling remote code execution on vulnerable Tenda AC15 AC1900 devices.