Tenda WH450
CVE-2025-15044
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface over network
-
DeliverySend crafted POST to /goform/NatStaticSetting
-
ExploitOverflow stack buffer via oversized 'page' argument
-
ExecutionHijack control flow / corrupt stack
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface and the ability to send a request to the /goform/NatStaticSetting endpoint with a manipulated 'page' argument; per the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against the affected Tenda WH450 firmware 1.0.0.18. The primary limiting factor is exposure: these are SOHO/access-point devices whose web interface is normally LAN-facing, so remote Internet-wide exploitation depends on the management interface being exposed to the WAN or the attacker being on the local network; exploitation is also constrained to the specific firmware build 1.0.0.18. Note the PR:N assumption should be validated, as some Tenda /goform handlers are reachable only after login. |
| Impact | The CVSS 4.0 base score of 8.9 reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) stack-based buffer overflow with high impact to confidentiality, integrity and availability of the device itself (VC:H/VI:H/VA:H, no scope change to subsequent systems). Publicly available exploit code exists (referenced PoC on GitHub by z472421519), and the CVSS carries E:P (proof-of-concept exploit maturity), which is consistent with that PoC rather than confirmed mass exploitation. This is NOT CISA KEV-listed, and the EPSS score is low at 1.08% (65th percentile) - meaning that despite a public PoC and a high CVSS, there is currently no statistical signal of widespread active exploitation. The signals are therefore consistent but point to opportunistic/targeted rather than mass exploitation: high theoretical severity and a working PoC, but modest real-world exploitation probability so far. Note this advisory originates solely from VulDB (cna@vuldb.com) with no corroborating Tenda vendor advisory; the PR:N (unauthenticated) assumption is typical for Tenda /goform endpoints but was NOT explicitly confirmed by vendor documentation - verify whether the NatStaticSetting handler requires an authenticated session on this firmware. |
| Exploit ScenarioDerived | A remote attacker on a network path to the device's web management interface sends a crafted HTTP request to /goform/NatStaticSetting with an oversized 'page' argument, overflowing a stack buffer in the request handler. A public proof-of-concept already exists, lowering the barrier to reproduction; a reliable overflow can crash the device (denial of service) or, with controlled payload construction, execute arbitrary code on the embedded firmware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to corrupt memory and potentially hijack execution flow by sending a crafted request to /goform/NatStaticSetting with an oversized 'page' argument (CVSS 4.0 base 8.9; independent assessment CVSS 3.1 9.8-equivalent vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact to the device). Publicly available exploit code exists in the z472421519/BinaryAudit repository, including a reproduce walkthrough, but there is no CISA KEV listing, so active exploitation is not confirmed. EPSS is 1.08% (65th percentile) - modest but non-trivial for an internet-exposed SOHO device - and the practical risk is gated by exposure, since the WH450 management interface is typically LAN-facing and only reachable from the WAN if remote web administration has been enabled or the device is port-forwarded.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available intelligence - the VulDB and GitHub references document the flaw and a working PoC but point to no patched build - so owners should check https://www.tenda.com.cn/ for a WH450 firmware release newer than 1.0.0.18 and apply it if one appears, and otherwise treat the device as end-of-life and replace it. Actionable compensating controls, in order of effectiveness: disable remote/WAN web management and keep the administration interface bound to the LAN only, which removes the AV:N path entirely at the cost of losing off-site administration; block inbound TCP/80 and TCP/443 to the router from untrusted networks at the upstream firewall or ISP router, accepting that any legitimate port-forwarded management access must move behind a VPN; place the WH450 on an isolated management VLAN or IoT segment so a compromised device cannot pivot, at the cost of extra network configuration; if a reverse proxy or WAF fronts the device, reject POST requests to /goform/NatStaticSetting whose 'page' parameter exceeds expected length, understanding that this may break legitimate static NAT configuration through the UI; and monitor device logs or IDS signatures for anomalous POSTs to /goform/NatStaticSetting. Because publicly available exploit code exists, prioritize inventory and exposure checks for any WH450 reachable from the internet.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Tenda WH450's embedded HTTP management daemon, which dispatches form submissions under /goform/ to handler functions. The NatStaticSetting handler reads the user-supplied 'page' parameter and copies it into a fixed-size stack buffer without any length or bounds validation, the classic CWE-119 improper-restriction-of-operations-within-memory-bounds pattern that manifests here as a stack-based buffer overflow (CWE-121 subtype). Because the overflow occurs on the stack, an oversized value can overwrite adjacent locals and the saved return address, giving an attacker control of the instruction pointer when the handler returns; on MIPS/ARM router firmware of this class the usual outcome is code execution in the context of the httpd process (commonly root), with full loss of confidentiality, integrity and availability on the device but no scope change to downstream systems. The vulnerability is specific to firmware build 1.0.0.18 (CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18); the CVSS 4.0 vector supplied by the CNA scores network reachability, low attack complexity, no privileges (PR:N) and no user interaction, matching the independent assessment's AV:N/AC:L/PR:N/UI:N profile, though analysts should validate the PR:N assumption because some Tenda /goform handlers are only reachable after an authenticated session.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable unauthenticated web endpoint with low-complexity overflow (AV:N/AC:L/PR:N/UI:N); memory corruption on the embedded OS yields full C/I/A impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
Executive ViewAI
Tenda WH450 access points running firmware 1.0.0.18 carry an unpatched, unauthenticated memory-corruption flaw in their web management interface that can be triggered by a single crafted request, with publicly available exploit code but no confirmed active exploitation. Leadership should care because the vendor has not released a fix, so any of these devices reachable outside the internal network remain exposed indefinitely and could be taken over to gain a foothold inside the perimeter. Organizational exposure is concentrated in branch and home-office deployments where remote administration has been enabled or ports forwarded, rather than in the data center.
No vendor patch is available; restrict the WH450 web management interface to a trusted administrative VLAN or management subnet, disable remote/WAN web administration and remove port forwards, block inbound access to the device UI at the perimeter, monitor for requests to /goform/NatStaticSetting with oversized parameters, and retire or replace units that cannot be segmented away from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB