Tenda WH450
CVE-2025-15007
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend crafted request to /goform/L7Im
-
ExploitOverflow stack buffer via 'page' argument
-
ExecutionHijack control flow on firmware
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and the ability to send a request to the /goform/L7Im endpoint with an attacker-controlled 'page' parameter; per the supplied vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed against the affected Tenda WH450 firmware 1.0.0.18. The primary limiting factor is exposure of the web interface: SOHO routers typically expose management only on the LAN by default, so the practical blast radius depends on whether the interface is reachable by the attacker (e.g., WAN-exposed admin, hostile LAN, or chained local access). The flaw is also tied to this specific model and firmware build, bounding the affected population. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 8.9 with E:P exploit-maturity set to Proof-of-Concept) describes a remotely reachable, unauthenticated, low-complexity stack-based buffer overflow with high impact to confidentiality, integrity and availability - on paper a top-tier priority. Multiple signals, however, temper the real-world urgency. Publicly available exploit code exists (github-poc reference), which raises likelihood, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, so there is no confirmed in-the-wild use. The EPSS score is only 1.00% (62nd percentile), which is modest and suggests exploitation is plausible but not yet widespread or automated at scale - consistent with a freshly disclosed SOHO-router bug that has a PoC but limited mass scanning so far. There is no SSVC decision record in the input, so exploitation-status/automatable/technical-impact cannot be read from a vendor framework. The combination (network vector + public PoC + high impact, but low EPSS and no KEV) points to a genuinely exploitable flaw whose practical risk is gated by how exposed the affected device's web interface is to untrusted networks rather than by any missing capability. Net: treat as a real, actionable issue for anyone running the affected device with a reachable management interface, but not an emergency on the level of a KEV-listed, actively exploited vulnerability. Note the reporter (cna@vuldb.com) and all 'nvd' references actually point to VulDB entries, not NVD records - the affected-version and metadata provenance is VulDB, which should be weighed accordingly. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface sends a crafted HTTP request to /goform/L7Im with a malicious 'page' argument, overflowing a stack buffer in the HTTP request handler. Because exploitation requires no authentication and no user interaction, this can be driven directly to crash the device or achieve code execution on the embedded firmware. Public proof-of-concept exploit code is already available (github.com/z472421519/BinaryAudit), lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution by sending a crafted request to the /goform/L7Im endpoint with an oversized 'page' parameter. Per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials, special configuration, or user interaction are required, and publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), though CISA KEV does not list this issue as actively exploited. EPSS places exploitation likelihood at roughly 1.00% (62nd percentile), reflecting that the practical exposure depends on whether the router's web management interface is reachable by the attacker, since SOHO devices of this class typically restrict administration to the LAN by default.
RemediationAI
No vendor-released patch was identified in the available data for Tenda WH450 firmware 1.0.0.18, so the primary recommendation is to check https://www.tenda.com.cn/ and the VulDB entry (https://vuldb.com/?id.337713) for a firmware update and apply it as soon as Tenda publishes one, then re-verify the affected build version. Until a fix is available, the most effective compensating control is to remove reachability of the web management interface from untrusted networks: disable WAN-side remote administration, ensure the administrative GUI is bound only to the LAN, and block TCP/80 and TCP/443 (and any alternate management port) inbound at the perimeter firewall - this neutralizes the flaw for external attackers but leaves the device exposed to anyone already on the LAN or to anyone who can reach the router through a chained compromise. Further restrictions worth applying, with their trade-offs, are: segmenting the router's management VLAN away from guest and IoT networks (limits lateral reachability from a hostile LAN host, at the cost of added network complexity); placing the device behind a reverse proxy or access-control list that only permits management from a single administrative IP (reduces the attack surface but adds a single point of failure and may break legitimate remote management); and, since the vulnerable endpoint is a specific /goform/L7Im handler, using a filtering appliance or WAF rule to reject requests to /goform/L7Im containing oversized 'page' parameters (effective as a targeted stopgap but trivially bypassable if the device is reachable directly and not all encoding variants are covered). Because the bug is a memory-corruption issue with an unauthenticated network trigger, treating the device as untrusted - replacing it with a supported model that receives firmware updates - is the only durable fix if no patch materializes; monitoring the device for unexpected reboots or crashes can serve as a coarse signal of exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the HTTP request handler of the Tenda WH450 SOHO router firmware, specifically the /goform/L7Im form handler, which processes the 'page' argument supplied in an HTTP request. The underlying weakness is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): user-controlled input is copied into a fixed-size stack buffer without adequate length validation, so an oversized value overwrites adjacent stack memory, including saved control data. Because the overflow occurs in a network-facing parsing path reachable before any authentication check, the corruption is triggerable by a single remote request; the classic consequence of this class of bug on embedded MIPS/ARM router firmware is denial of service (device crash/reboot) and, where offsets and mitigations permit, control-flow hijacking leading to arbitrary code execution in the context of the router's web service. The CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18 pins the affected artifact to the WH450 firmware build 1.0.0.18.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated remote request to a web endpoint with no user interaction gives AV:N/AC:L/PR:N/UI:N; a buffer overflow enabling code execution on the device justifies full C:H/I:H/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the component HTTP Request Handler. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Tenda WH450 routers running firmware 1.0.0.18 are affected by a high-severity stack-based buffer overflow that allows unauthenticated attackers to potentially execute arbitrary code on the device. Publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Organizations using these routers should act to mitigate the risk, as a compromised device could provide a foothold for broader network attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface to LAN only, disable remote administration, block access to /goform/L7Im from untrusted networks, segment devices into isolated VLANs, and monitor for unusual activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB