Tenda AC15 - RCE (CVE-2020-10987)

CVE-2020-10987 is a critical vulnerability in the Tenda AC15 AC1900 router that allows remote attackers to execute arbitrary system commands through the deviceName POST parameter at the goform/setUsbUnload endpoint. This flaw can be exploited to gain full control over the device, potentially leading to data theft, network compromise, or further attacks within the affected network environment.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network data shows that most actors exploiting CVE-2020-10987 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2020-10987 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2020-10987 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the /goform/setUsbUnload endpoint by sending crafted POST requests where the deviceName parameter contains injected system commands, enabling remote code execution on vulnerable Tenda AC15 AC1900 devices.