Tenda WH450
CVE-2025-15010
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on network
-
DeliverySend crafted request to /goform/SafeUrlFilter
-
ExploitOverflow stack buffer via oversized 'page' arg
-
ExecutionHijack control flow / execute code
-
ImpactGain control of router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and the ability to send a request to the /goform/SafeUrlFilter endpoint with an attacker-controlled 'page' parameter; no authentication is required per CVSS PR:N and no user interaction per UI:N. The primary limiting factor is exposure of that interface: on default SOHO deployments the admin web UI is LAN-facing, so a practical attacker typically needs local-network adjacency unless WAN-side remote management has been enabled. Affected build is specifically Tenda WH450 firmware 1.0.0.18. |
| Impact | Signals are mixed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a remotely reachable, low-complexity, unauthenticated flaw with full compromise of confidentiality, integrity and availability - consistent with a stack-based buffer overflow (CWE-119) in an exposed /goform endpoint that can yield remote code execution on the device. The exploit maturity flag E:P and the presence of a public PoC (z472421519/BinaryAudit) confirm that working exploit code exists. However, the EPSS score is only 1.00% (62nd percentile), indicating low modeled probability of broad near-term exploitation, and this CVE is NOT in CISA KEV, so there is no evidence of active exploitation in the wild. The practical limiter is exposure: embedded SOHO router web interfaces are typically LAN-facing, so unauthenticated 'network' exploitation most realistically applies to an attacker already on the local network (or a WAN-exposed management interface, which is non-default). Net assessment: a genuinely high-severity, RCE-class bug with public PoC that warrants patching/firmware replacement, but real-world mass-exploitation risk is tempered by the device's limited deployment footprint and the LAN-adjacency normally required. The disclosure originates solely from VulDB; no independent Tenda advisory was provided to confirm affected-version boundaries or a fix. |
| Exploit ScenarioDerived | An attacker with network access to the router's web interface (typically the LAN, or a WAN-exposed management port) sends a crafted HTTP request to /goform/SafeUrlFilter with an oversized 'page' parameter, overflowing a stack buffer. A public PoC exists (BinaryAudit repository), lowering the barrier to weaponization and enabling denial of service or, with a crafted payload, remote code execution on the device without authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory on the device by sending a crafted 'page' parameter to the /goform/SafeUrlFilter endpoint, with high impact to confidentiality, integrity and availability per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists, but EPSS estimates only a 1.00% chance of exploitation in the next 30 days (62nd percentile) and no CISA KEV listing indicates confirmed active exploitation. Signals are mixed: the technical severity is high, yet the practical attack surface is limited because the HTTP management interface on default SOHO deployments is LAN-facing, so a real-world attacker generally needs local-network adjacency unless WAN-side remote management has been enabled.
RemediationAI
No vendor-released patch was identified at the time of analysis: the reference set contains only VulDB records and the Tenda corporate homepage, with no fixed firmware version published. Administrators should check https://www.tenda.com.cn/ for a WH450 firmware update above 1.0.0.18 and apply it if one appears; if the model has reached end-of-support, plan replacement, since an unpatched, unauthenticated memory-corruption bug in a management daemon cannot be remediated by configuration alone. Compensating controls: disable WAN-side remote management and UPnP port-forwarding of the admin UI so the HTTP interface is reachable only from the LAN, and place the management VLAN behind firewall rules that permit only trusted administrative hosts to reach TCP 80/443 on the device (trade-off: legitimate remote administration now requires a VPN or jump host); segment IoT/SOHO routers onto an isolated VLAN so a compromised device cannot pivot to user systems (trade-off: added network complexity and cross-VLAN policy maintenance); monitor or IDS-alert on HTTP requests to /goform/SafeUrlFilter with unusually long 'page' parameters as an exploitation attempt indicator (trade-off: false positives from legitimate configuration changes and no protection once the request is delivered). Because public exploit code exists, treat any internet-exposed WH450 as already at risk and rotate credentials and review configuration after remediation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper restriction of operations within memory bounds, manifesting as a stack-based buffer overflow (CWE-121 subtype) in the embedded HTTP management service of the Tenda WH450 router. The /goform/SafeUrlFilter handler is one of the CGI-style 'goform' endpoints used by Tenda's web UI to configure URL filtering; the 'page' argument supplied in the request is copied into a fixed-size stack buffer without adequate length validation, so an oversized value overwrites adjacent stack memory, including the saved return address, giving an attacker potential control of the instruction pointer. Embedded router firmware of this generation typically ships without stack canaries or ASLR, which lowers the bar for turning a crash into reliable code execution, though the exploit's success still depends on the specific build and any vendor hardening. The CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18 confirms the scope is firmware version 1.0.0.18 running on the WH450 hardware platform; the CVSS:4.0 vector supplied by the CNA carries E:P (proof-of-concept exploit maturity), consistent with the linked public PoC write-up.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated, low-complexity HTTP request to an exposed endpoint (AV:N/AC:L/PR:N/UI:N); stack overflow enables code execution with full device compromise, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda WH450 access points running firmware 1.0.0.18 carry an unauthenticated memory-corruption flaw in the /goform/SafeUrlFilter handler that lets anyone with network reach to the device's management interface crash or seize control of the unit. No vendor-released patch has been identified and public exploit code is circulating, so affected units - typically branch and small-office wireless deployments that sit outside centralized patch programs - stay exposed until they are segmented or replaced. Leadership should care because a compromised access point provides a trusted on-network foothold for lateral movement into systems at exactly the sites with the least security oversight.
No vendor patch: disable WAN-side remote management and any port forwarding to the web UI, restrict /goform/SafeUrlFilter access to a trusted administrative VLAN or host allowlist, isolate affected WH450 units on a segmented network with no path to production systems, monitor for anomalous management-interface traffic or reboots, and replace units that cannot be adequately isolated or that remain unsupported by the vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB