Tenda WH450
CVE-2025-14665
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WH450 HTTP interface
-
DeliverySend crafted /goform/DhcpListClient request
-
ExploitOverflow 'page' arg on stack
-
ExecutionHijack control flow
-
ImpactExecute code / crash router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the Tenda WH450 (firmware 1.0.0.18) HTTP management interface and the ability to send a request to /goform/DhcpListClient with a manipulated 'page' parameter. The vendor-supplied vector claims no authentication (PR:N), but the description does not confirm this - if the DHCP client-list endpoint sits behind the router admin session, valid credentials or an authenticated session would be required, limiting exploitation. Practical exposure is largely confined to attackers on the same LAN unless the web UI is deliberately WAN-exposed. No user interaction is needed. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 8.9) portrays a network-reachable, low-complexity, unauthenticated stack overflow yielding full compromise of the device. The E:P temporal metric aligns with the confirmed public PoC on GitHub (z472421519/BinaryAudit). However, several signals temper this: there is no EPSS score and no CISA KEV listing provided, so exploitation is 'publicly available exploit code exists' - NOT confirmed active exploitation. The most important caveat is the PR:N (unauthenticated) claim: the description says only that manipulation of the 'page' argument to /goform/DhcpListClient triggers the overflow and 'the attack can be executed remotely,' with no explicit statement about whether authentication is required. Many Tenda /goform endpoints are reachable pre-auth, but this is vendor-asserted (VulDB/cna@vuldb.com) and not independently confirmed; if the DHCP client-list handler actually sits behind the router's admin session, real-world PR should be L, materially lowering practical risk. CWE-119 is a loose generic parent for what is described as a stack-based overflow (properly CWE-121). Net: a genuinely serious flaw on the affected firmware, but the product is a niche consumer/SOHO Tenda device with a small footprint, VulDB-sourced with no NVD-corroborated analysis, so this is a low-priority issue for most enterprise defenders despite the high score. |
| Exploit ScenarioDerived | An attacker with network reachability to a Tenda WH450 (1.0.0.18) management interface sends a crafted HTTP request to /goform/DhcpListClient with an oversized/malformed 'page' parameter, smashing the stack in the HTTP request handler. A public PoC is available (GitHub z472421519/BinaryAudit), enabling either device crash (DoS) or, with a working ROP/shellcode chain, code execution on the router. Exposure is greatest where the web UI is reachable from the LAN or, worse, exposed to the WAN. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
RemediationAI
No vendor-released patch was identified at time of analysis - none of the supplied references point to a fixed firmware build, a GitHub commit or a Tenda security advisory, and the only Tenda-owned link is the corporate homepage. Until Tenda ships a corrected firmware version, treat the device as unfixable in place and apply compensating controls, accepting their trade-offs: disable WAN-side/remote management and UPnP port mapping so the web UI is reachable only from the LAN (this blocks the likely remote vector but removes remote administration convenience), and place the router behind a managed firewall or on an isolated VLAN/guest segment so only trusted hosts can reach TCP/80 (or 443) on the management interface. If the endpoint is confirmed to be pre-authentication, a reverse proxy or ACL rule blocking requests to /goform/DhcpListClient provides immediate protection at the cost of breaking DHCP client-list display in the admin UI, and the same proxy can enforce request-length limits that would prevent the oversized 'page' value from reaching the handler; verify against the reproduction steps at https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/DhcpListClient/DhcpListClient.md#reproduce that the rule actually blocks the crash. Set strong unique admin credentials and disable the default account in case the endpoint is in fact authenticated (the vendor claims PR:N but this is unconfirmed), monitor device logs for malformed requests to /goform/DhcpListClient, and consider replacement with a supported router if Tenda does not issue firmware, since the device is at end of effective support. Verify any claimed fix version directly against Tenda before deploying it, as no patched version number appears in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-119, the parent class covering improper restriction of operations within the bounds of a memory buffer) inside the HTTP request handler of the Tenda WH450 firmware, a consumer-grade router. The affected binary path /goform/DhcpListClient is a goform-style CGI endpoint that renders the router's DHCP client list; the 'page' argument is copied into a fixed-size stack buffer without length validation, so an oversized value overwrites adjacent stack memory. On an embedded MIPS/ARM router this class of bug typically yields control-flow hijacking of the web server process, which usually runs with root privileges, translating into full device compromise - consistent with the assessed vector's high confidentiality, integrity and availability impact and no scope change (the vulnerable component and the impacted component are the same). The affected asset is identified by CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18:*:*:*:*:*:*:*, i.e. the firmware image rather than the hardware itself, and no CPE for a patched build is present in the supplied intelligence. Note the scoring divergence: the vendor/NVD record uses CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, plus E:P for proof-of-concept maturity) while the independent assessment uses CVSS 3.1 with PR:L - the only material disagreement is the authentication prerequisite, and the description does not independently confirm that /goform/DhcpListClient is reachable pre-authentication.
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network HTTP overflow with likely code exec (C/I/A:H); PR:L rather than PR:N because router /goform admin endpoints commonly require a session and auth is not confirmed in the description.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/DhcpListClient of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
A high-severity vulnerability in Tenda WH450 router firmware 1.0.0.18 could allow an attacker to corrupt device memory, causing outages or enabling control of the router, with high confidentiality, integrity, and availability impact. Publicly available exploit code exists, making exploitation easier, though there is no CISA KEV listing indicating confirmed active exploitation. Leadership should care because affected routers can disrupt connectivity, expose network traffic, or provide a foothold into the environment, especially if the web interface is exposed beyond the LAN.
No vendor-released patch identified at time of analysis; restrict web management to trusted VLANs, disable WAN/remote administration, block untrusted access to /goform/DhcpListClient, segment affected routers, monitor for exploitation, and replace unsupported devices where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Exploit-DB