CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
Other sources
Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or restrict network access to the vulnerable endpoint path on affected devices: deny incoming HTTP(S) POST requests to "/goform/setUsbUnload" (the Tenda AC15 USB unload endpoint) at the perimeter firewall, WAF, or router ACL. If access is required, allow only from specific trusted management IP addresses.
- Operational
Search webserver/device logs and network proxies for POST requests to "/goform/setUsbUnload" (look for requests containing the deviceName parameter). Investigate any such requests for signs of exploitation and, if compromise is suspected, isolate the device and restore from a known-good backup or factory reset.
Event History
Frequently Asked Questions
What is the vulnerability ID for the Tenda AC1900 Router AC15 Model Remote Code Execution vulnerability?
The vulnerability ID for the Tenda AC1900 Router AC15 Model Remote Code Execution vulnerability is CVE-2020-10987.
What is the severity of CVE-2020-10987?
The severity of CVE-2020-10987 is critical with a severity value of 9.8.
How does the Tenda AC1900 Router AC15 Model Remote Code Execution vulnerability allow attackers to execute arbitrary system commands?
The Tenda AC1900 Router AC15 Model Remote Code Execution vulnerability allows remote attackers to execute arbitrary system commands via the deviceName POST parameter in the goform/setUsbUnload endpoint.
What software versions are affected by CVE-2020-10987?
CVE-2020-10987 affects Tenda AC15 AC1900 version 15.03.05.19.
Is the Tenda AC15 router vulnerable to CVE-2020-10987?
No, the Tenda AC15 router is not vulnerable to CVE-2020-10987.