CVE-2020-10987

Name of the Vulnerable Software and Affected Versions Tenda AC15 AC1900 version 15.03.05.19

Description Remote attackers can execute arbitrary system commands due to insufficient neutralization of special elements passed in the URI. This is possible via the 'goform/setUsbUnload' endpoint using the deviceName POST parameter. Real-world incidents have been observed where this issue was exploited to deliver a DDOSAgent.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the deviceName parameter in the 'goform/setUsbUnload' endpoint to minimize the risk of exploitation.