[ CVE-2020-10987 · Published 13 Jul 2020 ]

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 80%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
EPSS: 80% chance of exploitation in the next 30 days (higher than 100% of CVEs)
Critical severity: CVSS 9.8

[ Description ]Official description

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

CISA: Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26…ExploitThird Party Advisory
www.ise.io/researchThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource