Tenda WH450
CVE-2025-15162
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated access to router web UI
-
ExploitSend crafted request to /goform/RouteStatic
-
ExecutionOverflow stack buffer via oversized 'page' argument
-
ImpactExecute arbitrary code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the Tenda WH450 web management interface, consistent with the PR:H metric - the attacker must send a crafted HTTP request to the /goform/RouteStatic endpoint with a manipulated 'page' argument that exceeds the target stack buffer. Limiting factors: valid high-privilege (administrative) credentials are required; the router's management interface must be network-reachable from the attacker (typically LAN-side, as SOHO routers rarely expose admin to the WAN by default); and the device must run the specific affected firmware 1.0.0.18. No end-user interaction beyond the attacker's own authenticated session is needed (UI:N). |
| Impact | This is a stack-based buffer overflow (CWE-119) in the /goform/RouteStatic handler of Tenda WH450 router firmware 1.0.0.18, triggered via the 'page' argument. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) yields a base score of 7.3 (High) and is internally consistent: network-reachable, low complexity, but requiring high privileges (PR:H) - meaning an attacker must already be authenticated to the router's management interface, which substantially lowers real-world risk versus a pre-auth flaw. A public proof-of-concept exists (GitHub, z472421519/BinaryAudit), so publicly available exploit code exists; however, this is NOT the same as active exploitation. The CVE is NOT listed in CISA KEV, and no EPSS score is provided in the input, so exploitation probability cannot be quantified from the data given. The PR:H requirement is the dominant mitigating factor: an unauthenticated internet attacker cannot reach this directly, and SOHO routers rarely expose their admin panel to the WAN by default. Net assessment: a legitimately High-severity memory-corruption bug with a working PoC, but gated behind admin authentication on a low-footprint consumer device - a moderate, not top-tier, patching priority unless the affected device population is directly managed or internet-exposed. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials (or who has pivoted onto the LAN and reached the router's web UI) sends a crafted HTTP request to /goform/RouteStatic with an oversized or malformed 'page' parameter, overflowing a fixed-size stack buffer. A public PoC demonstrating the overflow is available on GitHub, lowering the effort to reproduce the crash and potentially achieve code execution or denial of service on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated administrator to corrupt memory and potentially execute arbitrary code by sending a crafted HTTP request to the /goform/RouteStatic endpoint with an oversized 'page' argument. Exploitation requires high-privilege credentials (CVSS PR:H) and network reachability to the router's management interface, which on SOHO devices is typically LAN-side rather than exposed to the WAN. Publicly available exploit code exists (a GitHub proof-of-concept walkthrough of the RouteStatic overflow), so the barrier to reproduction is low for anyone who already has admin access; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
RemediationAI
No vendor-released patch was identified in the provided data; the only Tenda reference is the product homepage, and no fixed firmware version is published in the advisory set, so owners of WH450 units on 1.0.0.18 should treat the device as unpatched and watch the Tenda support site for a firmware update. In the interim, apply specific compensating controls: ensure the router's administrative web interface is never reachable from the WAN and is bound to the LAN/trusted segment only (disabling remote management), since the attack requires authenticated access over HTTP to /goform/RouteStatic; enforce strong, non-default administrator credentials and rotate them, as the PR:H metric means the overflow is only reachable after login and weak or default admin passwords collapse that barrier; where the deployment permits, place the WH450 behind a firewall rule or reverse proxy that blocks POST traffic to /goform/ endpoints from untrusted hosts, accepting the trade-off that legitimate management must then originate from an explicitly allowed host; and segment the router so that a compromised device cannot reach other network assets. Because the overflow is triggered by an oversized 'page' argument, network monitoring for abnormally long POST bodies targeting /goform/RouteStatic provides a practical detection heuristic, though it is a compensating measure rather than a fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-119 improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer condition manifesting as a stack-based buffer overflow (CWE-121 subtype) in Tenda WH450 firmware. The device's embedded web management stack exposes GoAhead-style handlers under /goform/, and the RouteStatic handler copies the user-supplied 'page' parameter into a fixed-size stack buffer without validating its length, so an over-long value overwrites adjacent stack memory including return-address data, which can redirect execution flow. The affected asset is identified by CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18, meaning the flaw is tied to the firmware build rather than a separately patchable library, and the CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/E:P) shows a network-reachable, low-complexity attack that nonetheless demands administrative privilege and needs no user interaction. The independent assessment concurs with an equivalent CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), i.e. full confidentiality, integrity, and availability impact confined to the device itself.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin endpoint (AV:N/AC:L) but requires high-privilege authentication to reach /goform/RouteStatic (PR:H); memory corruption enables full device compromise, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
The Tenda WH450 router running firmware 1.0.0.18 contains a high-severity stack-based buffer overflow that an authenticated administrator could exploit via the management interface to corrupt memory and potentially execute arbitrary code on the device. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so organizations using this model in sensitive network segments face elevated risk of device compromise, lateral movement, or network disruption. Leadership should prioritize inventorying affected devices, restricting administrative access, and planning replacement if firmware remediation is not delivered.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management interface access to trusted LAN segments or VLANs, disabling WAN-side remote administration, enforcing strong unique administrator credentials and MFA where supported, monitoring for requests to /goform/RouteStatic, deploying firewall ACLs to block external management access, and planning device replacement or persistent segmentation if firmware remediation is not available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Exploit-DB