Tenda WH450
CVE-2025-15006
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP management interface
-
DeliverySend crafted request to /goform/CheckTools
-
ExploitOverflow stack buffer via oversized ipaddress argument
-
ExecutionHijack control flow / execute code
-
ImpactFull compromise of router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and the ability to send a request to the /goform/CheckTools endpoint with an attacker-controlled 'ipaddress' argument; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against the affected Tenda WH450 1.0.0.18 firmware. The practical limiting factor is exposure of the web management interface: if it is bound only to the LAN, exploitation requires an attacker already on the local network, whereas WAN-exposed management makes it remotely reachable from the Internet. Only the single firmware build 1.0.0.18 is confirmed affected by the available data. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated flaw delivering total confidentiality, integrity, and availability impact on the vulnerable device - consistent with a classic stack-based buffer overflow in an embedded HTTP handler that can yield remote code execution. Signals partially conflict on urgency: publicly available exploit code exists (POC referenced on GitHub), which raises practical risk, yet the EPSS score is only 0.97% (61st percentile), indicating no observed mass-exploitation activity, and the CVE is NOT on the CISA KEV list, so there is no confirmed active exploitation. The combination - easy, unauthenticated, full-impact, with a public POC but low EPSS and no KEV - suggests a genuinely dangerous bug that is not yet being exploited at scale, likely because the affected product (a single Tenda WH450 firmware build) has a limited footprint rather than because the flaw is hard to trigger. Note the vector encodes exploit maturity E:P (proof-of-concept), aligning with the POC-exists signal and not claiming weaponized/in-the-wild status. Treat as a high-priority patch for anyone operating this specific device, but not a broad fleet-wide emergency absent evidence of targeting. |
| Exploit ScenarioDerived | An attacker with network reachability to the device's web management interface sends a crafted HTTP request to /goform/CheckTools with an overlong 'ipaddress' argument, overflowing a stack buffer in the request handler. A public proof-of-concept is available, and because no authentication or user interaction is required, a reachable device can be crashed or potentially driven to execute attacker-controlled code. Exploitation is most realistic where the management interface is exposed to the LAN or, dangerously, to the WAN/Internet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially achieve arbitrary code execution on the device by sending a crafted HTTP request to the /goform/CheckTools endpoint with an oversized 'ipaddress' argument. The CVSS:4.0 vector (8.9, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) indicates the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction, so any device with an exposed management interface is directly at risk. Publicly available exploit code exists (a GitHub PoC walkthrough with reproduction steps), while EPSS is modest at 0.97% (61st percentile) and there is no CISA KEV entry, meaning no confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data for CVE-2025-15006, so remediation must start with compensating controls while tracking tenda.com.cn for an update. The single most effective mitigation is to eliminate exposure of the device's web management interface: disable WAN-side remote management and confirm that ports 80/443 on the WH450 are not reachable from the Internet, which reduces the attack to an on-LAN threat (trade-off: remote administration becomes impossible and must be performed locally). For higher assurance, block or filter HTTP requests targeting /goform/CheckTools at an upstream firewall, reverse proxy, or WAF (trade-off: the rule must be maintained and can be bypassed by path-encoding variants unless normalization is applied), segment the router's management plane onto a dedicated VLAN with strict access lists, and monitor logs for malformed 'ipaddress' parameters or anomalous crashes/reboots that indicate exploitation attempts. Because the overflow is reachable pre-authentication, credential hygiene and password changes do not mitigate it; if a patched firmware is never published, replacing the device with a supported model should be planned. The public proof-of-concept and reproduction steps are documented at https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/CheckTools/CheckTools.md and its '#reproduce' anchor, and can be used to validate that any mitigation actually blocks the crafted request.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP management service of the Tenda WH450 router firmware, which routes form submissions to handler routines under the /goform/ path. The CheckTools handler copies the user-supplied 'ipaddress' request parameter into a fixed-size stack buffer without validating its length, the classic CWE-119 (improper restriction of operations within the bounds of a memory buffer) pattern that in this codebase typically manifests as an unchecked strcpy/sprintf into a local array. Because the firmware targets embedded hardware where stack canaries, non-executable stack, and full ASLR are often absent or weakened, overwriting the saved return address can redirect control flow - making this more than a simple denial of service and a plausible remote code execution primitive. The vendor's own CVSS 4.0 vector and our independent CVSS:3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that the flaw is reachable pre-authentication over the network; the practical bottleneck is exposure, since the web UI is frequently bound to the LAN, in which case an attacker must already have a foothold on the local network, whereas an Internet-exposed management port makes it directly exploitable from anywhere.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated overflow in the HTTP handler (AV:N/AC:L/PR:N/UI:N); on an embedded router, code execution yields full C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the component HTTP Request Handler. This manipulation of the argument ipaddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Tenda WH450 firmware version 1.0.0.18 contains a stack-based buffer overflow that an unauthenticated, network-based attacker could exploit to potentially execute arbitrary code on the device, and publicly available exploit code exists. Organizations with this device exposed to untrusted networks - particularly those with internet-facing management interfaces - face a high risk of full device compromise, which could enable lateral movement, data interception, or disruption of network operations. Leadership should prioritize identifying and isolating these devices; no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling remote management, restricting management interface access to trusted networks via firewall or ACL, segmenting affected devices on isolated VLANs, monitoring for exploitation attempts against /goform/CheckTools, and planning device replacement if a patch is not forthcoming.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB