Tenda WH450
CVE-2025-15177
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
ExploitSend crafted request to /goform/SetIpBind
-
ExecutionOverflow stack buffer via oversized 'page' arg
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access at administrator privilege to the WH450 web management HTTP service (CVSS PR:H), then sending a request to the /goform/SetIpBind endpoint with a 'page' argument long enough to overflow the stack buffer in the HTTP request handler. No end-user interaction is needed (UI:N). The decisive limiting factor is the privilege requirement: an attacker must hold valid admin credentials or an active admin session, so the device is not exploitable by an anonymous remote attacker against a default, properly-credentialed configuration. Exposure is further limited to deployments where the management interface is reachable by the attacker (e.g., LAN, or WAN-side management if enabled). |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The supplied CVSS 4.0 vector (base 7.3) specifies AV:N/AC:L/PR:H/UI:N with full VC:H/VI:H/VA:H impact, meaning network-reachable but requiring high privileges (an authenticated admin session) and yielding complete compromise of the device. A public PoC exists (VulDB/GitHub), which raises practical risk, and this is reflected in the vector's E:P (Proof-of-Concept) temporal flag. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The PR:H requirement is the dominant mitigating factor: an attacker must already be authenticated to the router's management interface, which sharply narrows the realistic attacker population versus an unauthenticated flaw. Net assessment: a genuine code-execution bug on the device worth patching, but the authentication precondition plus absence of KEV/EPSS signals make it a lower operational priority than a comparable pre-auth overflow. EPSS and KEV data are missing from the input and should be verified before final prioritization. |
| Exploit ScenarioDerived | An attacker with valid administrator credentials (or a hijacked admin session) to the Tenda WH450 web interface sends a crafted HTTP request to /goform/SetIpBind with an oversized 'page' parameter, overflowing a stack buffer in the HTTP request handler. A public PoC documents the exact reproduction steps, making successful exploitation and arbitrary code execution on the router straightforward for an authenticated actor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote administrator overwrite stack memory through the 'page' argument of the /goform/SetIpBind endpoint, enabling a denial-of-service crash and potentially arbitrary code execution on the device. Exploitation requires valid administrator credentials or an active admin session (CVSS PR:H); no user interaction is needed, and the device is not reachable by anonymous remote attackers in a properly-credentialed default configuration. Publicly available exploit code exists (a detailed BinaryAudit PoC with reproduction steps is published on GitHub), but there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch or fixed firmware version has been identified in the available data.
RemediationAI
No vendor-released patch or specific fixed firmware version is identified in the available data, so remediation must begin with confirming whether Tenda has issued updated WH450 firmware through its support site and channel partners, and applying it immediately if one exists. Until a fix is confirmed, apply targeted compensating controls: disable WAN-side/remote administration so the web management interface is only reachable from the trusted LAN (side effect: administrators lose off-site access and must manage the device locally or over VPN), and place the management interface behind a firewall or ACL that restricts access to a small set of trusted administrative hosts (side effect: legitimate administrative access from other segments is blocked). Because exploitation requires administrator privilege (PR:H), enforce strong, unique admin credentials and rotate any default or shared passwords so session hijacking or credential reuse cannot supply the required privilege; note this reduces but does not eliminate risk if an admin session is already compromised. For high-value networks, replace or segment the WH450 on an isolated VLAN with no route to sensitive assets, accepting the operational cost of limited device functionality. Monitor device and upstream logs for repeated POST requests to /goform/SetIpBind with oversized 'page' values, which are a reliable indicator of exploitation attempts, and treat any unexplained web service crash on the device as a possible compromise requiring a reboot-to-factory-reset and credential rotation. Organizations that want to verify exposure can reproduce the condition in a lab using the public PoC (https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/SetIpBind/SetIpBind.md#reproduce), but should never test against production units.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an improper restriction of operations within the bounds of a memory buffer (CWE-119), manifesting specifically as a stack-based buffer overflow in the HTTP request handler that services the /goform/SetIpBind administrative endpoint. In embedded router firmware such as the Tenda WH450 (CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18), goform endpoints are handled by a lightweight embedded web server that parses form parameters into fixed-size stack buffers; the 'page' parameter is copied into such a buffer without adequate length validation, so an oversized value overwrites adjacent stack memory including the saved return address. Because the firmware is a single-binary, resource-constrained embedded image, protections such as stack canaries may be absent or weak, which is why the published PoC demonstrates a reproducible crash via the BinaryAudit harness (SetIpBind.md). The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) confirms network reachability with high confidentiality, integrity, and availability impact, gated only by the high privilege requirement (PR:H), which aligns with the independent assessment of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The practical consequence is that an attacker who already holds admin-level credentials - or who can hijack a live admin session - can reliably crash the web service and may be able to redirect execution, though end-to-end code execution depends on the target's memory layout and mitigations and is not asserted as proven by the available data.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable HTTP handler (AV:N/AC:L) but the SetIpBind admin function requires an authenticated privileged session (PR:H); successful overflow grants full device code execution (C:H/I:H/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda WH450 routers running firmware 1.0.0.18 are exposed to a high-severity stack buffer overflow that can be triggered by an authenticated administrator, leading to device crashes and potential remote code execution. With no vendor-released patch identified at time of analysis and publicly available exploit code, organizations using these devices at network edges face heightened risk. Leadership should prioritize mitigation because a compromised router can disrupt connectivity, enable lateral movement, and undermine trust in the network perimeter.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling WAN-side remote management, restricting admin access to trusted networks, isolating the device on a dedicated VLAN, enforcing strong unique admin credentials, monitoring for anomalous /goform/SetIpBind requests, and applying network-level filtering of the endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB