CVE-2020-10987

What it actually does

The goform/setUsbUnload endpoint accepts a deviceName POST parameter that is passed directly to system command execution without sanitization, enabling arbitrary command execution with the privileges of the web server process.

Why it matters to the business

Attackers can gain complete remote control of affected devices, leading to network compromise, data theft, or use as a pivot point; the vulnerability has been actively exploited in the wild with a CISA remediation deadline that has long passed, increasing urgency for any remaining instances.

How an attack unfolds

An unauthenticated attacker sends a crafted HTTP POST request to the vulnerable endpoint, embedding operating system commands inside the deviceName parameter; the server executes the commands, allowing the attacker to read files, install backdoors, or pivot further into the network. Public exploit code and active exploitation have been observed.

How to fix it

Upgrade pomerium/pomerium (GIT) to commit fff798d0e0e3993dfe68513d7874e03fdf679a96 or later. If the device cannot be updated, restrict network access to the management interface and disable USB-related functionality.

How to confirm the fix worked

Confirm the endpoint no longer executes injected commands by testing with a benign payload such as a sleep command and verifying the response contains no execution artifacts; review commit logs for the listed fix hash.

Typical attack path

1. Discover exposed web interface of the affected device
2. Craft malicious POST request to /goform/setUsbUnload with command payload in deviceName
3. Execute arbitrary commands to establish persistence or exfiltrate data
4. Pivot to other systems on the network

How to detect it

Search web server access logs for POST requests to /goform/setUsbUnload containing suspicious characters or command syntax in the deviceName parameter; look for unexpected process spawns or file modifications following such requests.

• POST /goform/setUsbUnload
• deviceName=.*[;&|`$]
• shell execution artifacts after USB unload requests

What your security team should do

• Immediately apply the listed commit or remove the device from the network
• Scan for any exposed instances of the vulnerable endpoint
• Monitor logs for suspicious POST requests containing shell metacharacters in deviceName
• Implement network segmentation to limit exposure of management interfaces