CVE-2020-10987

This is a flaw in a router’s web feature that lets an attacker “talk to the router” over the internet. If your device uses the specific firmware version, a malicious request can trick the router into running commands on its own—like handing over a remote control that can be used to disrupt your business network or spy on connected devices.

This matters if your business uses a Tenda AC15 AC1900 router running firmware 15.03.05.19 and the endpoint /goform/setUsbUnload is reachable. Because the flaw does not require authentication and is reachable in the default configuration, exposure is especially likely on typical setups where the router’s web interface is accessible from the network. The risk is highest when an attacker can reach that endpoint over the network (for example, from the internet).

This is RED because confirmed real-world attention has been captured in CISA’s KEV and it enables unauthenticated remote command execution. Attackers only need network reachability to trigger the flaw—no login and no user action are required. Treat it as an immediate patching priority for any affected firmware you still run.