Tenda WH450 CVE-2025-15164

Exploitation requires the attacker to reach the router's HTTP management interface and submit a request to the /goform/SafeMacFilter endpoint with an overlong 'page' parameter; the CVSS vector's PR:H indicates a privileged/authenticated web session to the WH450 admin panel is needed, which is the primary limiting factor since this interface is normally LAN-facing and not exposed to the internet by default. No user interaction is required (UI:N) and complexity is low (AC:L). Realistic risk is bounded by whether the management interface is remotely reachable and by the authentication barrier; exploitation is confined to Tenda WH450 firmware 1.0.0.18.

Signals are mixed and point to a moderate, not top-tier, priority. The provided CVSS 4.0 base scores 7.3 with AV:N/AC:L/AT:N/PR:H/UI:N and full VC:H/VI:H/VA:H, indicating a network-reachable memory-corruption flaw that nonetheless requires privileges (PR:H) to reach the vulnerable /goform/SafeMacFilter handler - consistent with a router web-management endpoint that sits behind authentication rather than an internet-facing unauthenticated service. A public PoC exists (E:P in the vector, plus the GitHub BinaryAudit writeup), which raises practical exploitability, but there is NO CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. The combination - real public exploit code against an embedded consumer/SMB router, but requiring prior privileged access and with no in-the-wild confirmation - reads as a targeted-opportunity bug rather than a mass-exploitation emergency. Note a conflict to verify: the input vector uses PR:H, yet the description gives no authentication detail and Tenda /goform handlers typically require only a logged-in web session, so the true privilege barrier may be lower (PR:L) - verify the auth requirement of SafeMacFilter with the vendor or PoC before downgrading its priority. EPSS is missing, which limits confidence in probabilistic prioritization.

An attacker with access to the Tenda WH450 web management interface sends a crafted request to /goform/SafeMacFilter with an oversized 'page' argument, overflowing a stack buffer in the MAC-filter handler. Because public exploit code is already released (GitHub PoC), a low-skill attacker on the same network or reaching an exposed management port can reliably trigger the overflow to crash the device or execute code on the router. Low attack complexity (AC:L) means the request needs no special timing or race conditions.