Security readout for executives and security teams
Plain-English summary
This is a critical command-injection flaw in Tenda AC15 AC1900 firmware version 15.03.05.19. A remote unauthenticated attacker could make the router run system commands, giving potential full control of the device. CISA lists it in KEV, so organizations should treat exposed or unmanaged devices as urgent risk.
Executive priority
Prioritize this for immediate exposure reduction because it is unauthenticated remote command execution on a network edge device and is listed in CISA KEV. If affected devices exist, isolate or replace them while vendor remediation is confirmed.
Technical view
CVE-2020-10987 is CWE-78 OS command injection in the goform/setUsbUnload endpoint. The CVE description identifies the deviceName POST parameter as the vulnerable input. CVSS 3.1 is 9.8 with network access, low complexity, no privileges, and no user interaction required.
Likely exposure
Exposure is most likely where Tenda AC15 AC1900 routers run firmware 15.03.05.19 and management interfaces are reachable from untrusted networks. The source bundle does not provide complete CPE data or broader affected-version ranges.
Exploitation context
Active exploitation is supported by CISA KEV listing for CVE-2020-10987. The referenced Security Evaluators blog title also describes Tenda AC1900 vulnerabilities as discovered and exploited. The prompt bundle does not provide exploit timing, scale, or observed campaigns.
Researcher notes
Structured affected-product metadata in the bundle is incomplete, but the CVE description names Tenda AC15 AC1900 version 15.03.05.19. No patch version is stated in the provided sources, so remediation should be anchored to vendor guidance and exposure removal.
Mitigation direction
- Identify any Tenda AC15 AC1900 devices and record firmware versions.
- Remove internet exposure for router administration interfaces immediately.
- Check Tenda or vendor guidance for fixed firmware or replacement advice.
- Restrict management access to trusted administrative networks only.
- Replace unsupported or unpatchable devices where vendor fixes are unavailable.
Validation and detection
- Inventory edge routers and confirm whether Tenda AC15 AC1900 is present.
- Verify firmware version against 15.03.05.19 from the CVE description.
- Check external exposure of router management services.
- Review logs for suspicious administrative activity or unexpected configuration changes.
- Confirm remediation through firmware status or documented device replacement.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-10987 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ise.io/research/CVE reference · x_refsource_MISC
- https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10987CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.