Is CVE-2020-10987 (Tenda AC1900 Router AC15 Model Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2020-10987 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

What “exploited in the wild” means for this router CVE

For a router vulnerability, “exploited in the wild” means you should treat it as active attacker tradecraft, not a theoretical flaw. The practical question is whether the device is exposed, whether management access is reachable from untrusted networks, and whether any signs of command execution, configuration tampering, or unexpected outbound traffic already exist.

Because this issue allows remote code execution through a request parameter, the first task is to confirm whether the affected model is present anywhere in your inventory and whether it is reachable in a way that an external attacker could target. In IoT environments, that often means checking both the router itself and any upstream management plane or remote administration path that may extend exposure.

A useful way to interpret the answer is to separate “known exploitation” from “known compromise.” CISA KEV status tells you the vulnerability has been observed in active exploitation, but it does not by itself prove your device has already been compromised. The response should therefore combine exposure validation with compromise checks, not just patch planning. For background on IoT attack surface and device hardening, see the IoT Security Guide.

Why router RCE vulnerabilities are operationally high-risk

Routers sit at a high-value trust boundary. If an attacker can execute commands on the device, they may be able to alter routing, intercept traffic, change DNS settings, open remote access, or use the router as a foothold into adjacent systems. That makes the impact broader than a single appliance failure, because the device can become a pivot point for the network it protects.

The risk is especially serious when the router is customer-facing, remotely managed, or reused across multiple locations with similar configuration. In those cases, one weak deployment pattern can create repeated exposure at scale. When a vulnerability is actively exploited, patch urgency is not just about availability, it is about stopping an attacker from turning a perimeter device into persistent infrastructure. Current vulnerability triage guidance is clearer when paired with a dedicated process such as the Vulnerability Management Guide.

If you need a broader comparison point for how actively exploited flaws are handled, the same emergency mindset used for other KEV-listed issues applies here: treat the router as exposed until you can prove otherwise, and prioritise mitigation over normal change windows. The Zero-Day and Exploited Vulnerabilities Guide is useful for structuring that response.

What to verify before you assume the device is clean

First verify whether the router is actually in scope, including any downstream resellers or branch deployments that may not appear in central asset lists. Then verify whether remote administration, WAN-side management, or exposed web interfaces were enabled around the time exploitation might have occurred. For consumer and small-office gear, missed inventory is often the main reason compromise goes unnoticed.

Next, check for indicators that the attacker may have issued commands rather than merely probed the device. That includes unexpected configuration changes, unknown admin accounts, altered DNS or NAT settings, suspicious firewall rules, reboot loops, unusual logs, and traffic patterns that do not match normal router behaviour. If the device lacks sufficient logging, assume the visibility gap is part of the risk and widen your validation to the surrounding network.

When a router flaw is in active exploitation, compromise assessment matters as much as remediation. If you find evidence of command execution or tampering, rotate any credentials that may have been stored, reused, or exposed through the device, and review whether adjacent systems accepted traffic from the router as trusted. For exploitation-driven remediation workflows, the CISA Known Exploited Vulnerabilities Catalog, the NIST National Vulnerability Database, and the CVE Program are the authoritative references for record, status, and identifier context.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires prioritised vulnerability handling and exposure review.
Recommendation — Prioritise exposed routers in your vulnerability management workflow and verify remediation status quickly.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	You must confirm whether the router is deployed and exposed before judging risk.
	PR.PS-01 — Configuration Management	Router compromise risk hinges on hardened configuration and limiting remote management exposure.
Recommendation — Identify affected router assets and document their exposure before deciding on containment. Harden router configuration and remove unnecessary management exposure to reduce attack surface.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed router flaws require monitoring and validation of exposure and remediation status.
	SI-2 — Flaw Remediation	The issue is an exploited vulnerability that demands prompt remediation or mitigation.
Recommendation — Scan for the vulnerable router and track remediation until exposure is eliminated. Apply the vendor fix or a compensating mitigation as soon as practical.

Practitioner Guidance

What to prioritise: Treat exposed edge routers and branch devices as the highest priority when a CVE is on the KEV list. If you cannot patch immediately, isolate the device, restrict management access, and remove any unnecessary remote administration exposure before doing anything else.

What to verify: Confirm whether the model is deployed, whether it is internet-reachable, and whether its configuration changed unexpectedly. If logs are limited, supplement with packet traces, upstream firewall telemetry, and any out-of-band management records you have.

Decision rule: If the router has any sign of command execution or unexplained configuration drift, treat it as potentially compromised and investigate before returning it to service. If it cannot be verified cleanly, replacement is often safer than relying on partial evidence.

Practitioner takeaway: For active exploitation, the right question is not only “is there a patch,” but “can this device still be trusted to sit at the network boundary until the fix is applied and the router is proven clean?”