Tenda WH450
CVE-2025-15163
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to router web UI
-
DeliveryReach /goform/SafeEmailFilter endpoint
-
ExploitSend oversized 'page' argument
-
ExecutionOverflow stack buffer (CWE-119)
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated administrative session on the Tenda WH450 (1.0.0.18) web management interface - the CVSS vector specifies PR:H, so a privileged account is needed to reach the vulnerable /goform/SafeEmailFilter handler and supply a malicious 'page' argument. Limiting factors: the attacker must first obtain admin credentials (default/weak passwords materially ease this on SOHO routers), and the management interface must be reachable from the attacker's network position; no user interaction is required (UI:N) and attack complexity is low (AC:L) once authenticated. Impact is bounded to the single device (SC/SI/SA:N - no scope change to subsequent systems). |
| Impact | Signals are mixed and point to a real-but-contained issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) yields 7.3 (High), reflecting network reachability and low attack complexity but crucially requiring high privileges (PR:H) - i.e. an already-authenticated administrator on the device web UI. The E:P metric marks only a proof-of-concept, and a public PoC is indeed referenced, so exploit code exists but there is NO CISA KEV listing and no evidence of active exploitation. EPSS was not provided in the input, so widespread-exploitation probability cannot be quantified here. The PR:H requirement is the dominant mitigating factor: it reduces this from a wormable pre-auth RCE to a post-authentication memory-corruption bug, typically useful for privilege-boundary bypass or crashing the device after credentials are obtained. Note a tension: VulDB (cna@vuldb.com) is the sole CNA source and router admin interfaces are frequently exposed with weak/default credentials, so PR:H understates practical risk where default or reused admin passwords exist. Overall this is a moderate priority - patch on affected Tenda WH450 units, prioritize any that are internet-exposed, but it does not warrant the urgency of a pre-auth, KEV-listed flaw. |
| Exploit ScenarioDerived | An attacker who has authenticated to the Tenda WH450 web management interface (e.g. via default, weak, or reused admin credentials, or a reachable exposed panel) sends a crafted request to /goform/SafeEmailFilter with an oversized 'page' parameter. This overflows a stack buffer (CWE-119), allowing device crash or potential arbitrary code execution on the router. A public proof-of-concept is already available on GitHub, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Stack-based buffer overflow in the Tenda WH450 router running firmware 1.0.0.18 lets an authenticated administrator crash or potentially execute code on the device by sending an oversized 'page' argument to the /goform/SafeEmailFilter handler, which is reachable remotely over the web management interface. Publicly available exploit code exists (a BinaryAudit PoC on GitHub) and the CVSS v4.0 base score is 7.3 with PR:H, confirming that a privileged session is a prerequisite; there is no evidence of confirmed active exploitation (not in CISA KEV). Impact is bounded to the device itself - no scope change to downstream systems - but the high integrity and availability sub-scores mean a successful attack can fully compromise the router's configuration. Risk is real but contained: the main gating factor is obtaining admin credentials (default or weak passwords on SOHO routers materially ease this), and exposure of the management UI to untrusted networks.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied references contain no fixed firmware version or Tenda security advisory for the WH450, only the vendor homepage (https://www.tenda.com.cn/) and the VulDB entries (https://vuldb.com/?id.338538). Administrators should check Tenda's support pages for a firmware release newer than 1.0.0.18 and, if none exists, treat the device as unpatchable. Compensating controls, in order of effectiveness: (1) remove the router's web management interface from untrusted exposure by disabling remote/WAN administration and deleting any port-forward or DMZ rule pointing at TCP 80/443 on the device - trade-off is that management becomes LAN-only; (2) restrict administrative access to a dedicated management VLAN or trusted host list (firewall the /goform/ paths and the management port to specific source IPs) - trade-off is added configuration complexity and potential lockout if rules are wrong; (3) rotate the administrator password away from defaults and any vendor-preset value, since PR:H exploitation is trivial once credentials are known - trade-off is none beyond operational hygiene; (4) where the SafeEmailFilter feature is not needed, avoid using it and monitor logs for anomalous POSTs to /goform/SafeEmailFilter with abnormally long 'page' parameters; (5) if the device cannot be segmented or updated, replace it with a supported router, as an unpatched, remotely reachable stack overflow on an internet-exposed management UI with public exploit code is not a condition that compensating controls can safely hold indefinitely.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Tenda WH450's embedded HTTP management service, which exposes CGI-style handlers under the /goform/ path. The /goform/SafeEmailFilter endpoint processes HTTP parameters used to configure the router's email filtering feature; the 'page' argument is copied into a fixed-size stack buffer without validating its length, producing a classic stack-based buffer overflow. This maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the parent class of CWE-121 stack overflows. Such bugs are common in consumer/SOHO router firmware because the underlying toolchains frequently omit stack canaries and full ASLR, so a controlled overwrite of a saved return address or stack-resident structure can redirect execution. The CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18 identifies the vulnerable build precisely, meaning the flaw is in firmware, not in a separate application layer. Because the handler sits behind the administrative web UI, exploitation requires a valid privileged session (CVSS PR:H), although an attacker with default credentials, a CSRF-style pivot, or a session-hijacking position could satisfy that prerequisite. No version newer than 1.0.0.18 is documented in the supplied data as a fixed release.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform handler with low complexity, but the admin-only endpoint requires privileged authentication (PR:H); memory corruption can yield full code execution, so C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Executive ViewAI
Tenda WH450 routers running firmware 1.0.0.18 are affected by a high-severity stack-based buffer overflow that requires authenticated administrative access and has publicly available exploit code; no vendor-released patch identified at time of analysis. Organizations using these devices face a contained but real risk: a successful exploit could crash the router or potentially execute code, disrupting network connectivity and compromising device configuration. Leadership should care because these routers often sit at the network edge, and weak default credentials could enable an attacker to pivot into internal systems.
Restrict management interface to trusted internal networks, enforce strong unique admin credentials, disable remote web management, segment affected devices, and monitor for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Exploit-DB