Tenda WH450 CVE-2025-15045

Exploitation requires network access to the device's HTTP management interface and the ability to send a request to the /goform/Natlimit endpoint of the WH450 web server (the NAT-limit configuration handler); the overflow is triggered specifically through the 'page' argument. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated, so a reachable interface is the primary prerequisite. The key limiting factor is exposure: SOHO routers typically expose this interface only on the LAN by default, so remote internet-facing exploitation depends on the admin panel being reachable from the WAN (remote management enabled or misconfigured port forwarding). Confirmed affected build is firmware 1.0.0.18.

Signals are moderately consistent but point to a lower real-world priority than the raw 8.9 score suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a remote, low-complexity, unauthenticated flaw with high technical impact on confidentiality, integrity, and availability - a worst-case profile on paper. However, the EPSS score is low (1.08%, 65th percentile), indicating no observed mass exploitation activity, and the vulnerability is NOT on the CISA KEV list, so there is no confirmed active exploitation. A public proof-of-concept does exist (reflected in the CVSS E:P 'Proof-of-Concept' exploit maturity and the GitHub PoC reference), which raises the practical likelihood of opportunistic abuse. The combination of 'PoC exists + low EPSS + no KEV' is the classic VulDB-reported SOHO-router pattern: technically exploitable and documented, but not yet weaponized at scale. Net assessment: a credible remote code-execution/DoS risk for exposed Tenda WH450 devices, but prioritization should be driven by exposure (is the admin HTTP interface reachable?) rather than treated as an emergency. Note one caveat: the input provides only a CVSS 4.0 vector (no CVSS 3.1), and the impact is inferred from a stack-based buffer overflow (CWE-119) - RCE is likely but not explicitly confirmed by a vendor advisory.

An attacker with network reachability to the router's web management interface sends a crafted HTTP request to /goform/Natlimit with an oversized 'page' parameter, overflowing a fixed-size stack buffer in the HTTP request handler. A public proof-of-concept is already published (GitHub z472421519/BinaryAudit), lowering the barrier to reproduction. Because the CVSS vector indicates no authentication or user interaction is required (PR:N/UI:N/AC:L), a successful overflow can crash the device (DoS) or, with a tailored payload, achieve arbitrary code execution on the firmware.