CVE-2020-10987: listed in the CISA KEV catalog CVE-2020-10987 · CVSS 9.8 CRITICAL · EPSS 80% · KEV 2021-11-03
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
Is CVE-2020-10987 exploited? Listed in the CISA KEV catalog on 2021-11-03. Federal remediation due 2022-05-03. Past that date by 1565 days. EPSS puts exploitation in the next 30 days at 80%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2020-10987 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.
CVE-2020-10987: listed in the CISA KEV catalog CVE-2020-10987 · CVSS 9.8 CRITICAL · EPSS 80% · KEV 2021-11-03
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
Is CVE-2020-10987 exploited? Listed in the CISA KEV catalog on 2021-11-03. Federal remediation due 2022-05-03. Past that date by 1565 days. EPSS puts exploitation in the next 30 days at 80%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2020-10987 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.