Tenda AC15 - RCE (CVE-2020-10987)

CVE-2020-10987 is a critical vulnerability in the Tenda AC15 AC1900 router that allows remote attackers to execute arbitrary system commands through the deviceName POST parameter at the goform/setUsbUnload endpoint. This flaw can be exploited to gain full control over the device, potentially leading to data theft, network compromise, or further attacks within the affected network environment.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2020-10987 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2020-10987 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2020-10987 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /goform/setUsbUnload endpoint by sending crafted POST requests where the deviceName parameter contains injected system commands, enabling remote code execution on vulnerable Tenda AC15 AC1900 devices.