Tenda WH450
CVE-2025-15178
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to web UI
-
DeliverySend crafted request to /goform/VirtualSer
-
ExploitOverflow stack buffer via oversized 'page' arg
-
ExecutionHijack control flow and execute code
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the /goform/VirtualSer handler (the virtual-server / port-forwarding configuration endpoint) of the Tenda WH450 web management interface and is triggered by an oversized 'page' argument. Per the provided CVSS 4.0 vector (PR:H), a high-privilege authenticated session - i.e., administrative access to the router's web UI - is required, which is the primary limiting factor; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation further requires network reachability of the HTTP management interface, which on default deployments is typically LAN-side only, so internet-facing exposure depends on whether remote management has been enabled. Caveat: the description states the attack 'can be launched remotely' without an authentication qualifier, so if the endpoint is in fact reachable pre-authentication the PR:H limiter would not hold - verify against the PoC and vendor. |
| Impact | This is a stack-based buffer overflow (CWE-119) in the HTTP request handler of the Tenda WH450 router, reachable over the network via the /goform/VirtualSer endpoint by manipulating the 'page' argument. The only quantitative severity signal provided is a CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scoring 7.3, which indicates full confidentiality, integrity, and availability impact but - critically - requires high privileges (PR:H), meaning an authenticated administrator-level session is a prerequisite. Publicly available exploit code exists (a documented PoC on GitHub by researcher z472421519), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active in-the-wild exploitation. The net picture is a genuine remote-code-execution-class memory-corruption bug that is partly de-risked by the PR:H authentication requirement: an attacker must first obtain valid admin credentials (or chain an auth bypass), which sharply limits mass unauthenticated exploitation. Note a conflict to verify: the description states 'the attack can be launched remotely' with no mention of authentication, yet the vendor-assigned CVSS sets PR:H - this discrepancy (common in VulDB-sourced Tenda entries) should be confirmed against the actual PoC, as many Tenda /goform overflows are in practice reachable without authentication. Treat as a medium-priority patch-when-available item rather than an emergency, pending confirmation of the real authentication requirement. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (per CVSS PR:H, an authenticated admin session) sends a crafted HTTP request to /goform/VirtualSer with an oversized 'page' parameter, overflowing a stack buffer in the request handler. A public PoC demonstrating the crash/overflow is available on GitHub, lowering the effort to reproduce; successful exploitation can corrupt the stack to hijack control flow and execute attacker code on the device, with full compromise of the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user crash or potentially execute code on the device by sending an oversized 'page' parameter to the /goform/VirtualSer HTTP handler. The flaw is network-reachable (CVSS:4.0 base 7.3, AV:N/AC:L, PR:H, UI:N), so it requires an administrative session on the web management interface rather than pre-authentication access. Publicly available exploit code exists, including a proof-of-concept with reproduction steps published on GitHub, but there is no CISA KEV entry indicating confirmed in-the-wild exploitation. Successful abuse yields full loss of confidentiality, integrity, and availability on the router itself, though the assessed scope is unchanged (S:U) and no downstream systems are directly impacted.
RemediationAI
No vendor-released patch or fixed firmware version for CVE-2025-15178 is identified in the available data, so remediation must currently rely on compensating controls. Restrict the WH450 web management interface to a trusted LAN segment and, where the firmware allows it, explicitly disable remote/WAN administration so that /goform/VirtualSer is not reachable from untrusted networks; the trade-off is loss of remote management convenience and the need for on-site or VPN-based access. Ensure administrative credentials are strong and unique and rotate them, since the PR:H vector means an attacker must already hold an authenticated admin session - this does not fix the overflow but raises the bar for reaching the vulnerable code path. Network-layer mitigations include placing the device behind a firewall or access-control list that blocks inbound HTTP to the router's management port and segmenting the device on an isolated VLAN, accepting reduced manageability as the trade-off. Because public exploit code exists, monitor logs for abnormally long 'page' parameters or unexpected router reboots, and treat unexplained crashes of the management daemon as potential exploitation attempts. If the device cannot be secured or retired, the most robust option is to replace the WH450 with a router model receiving active firmware support; consult the vendor site (https://www.tenda.com.cn/) and the VulDB entry (https://vuldb.com/?id.338563) for any eventual firmware fix before relying on it.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a stack-based buffer overflow (CWE-119, the broad 'improper restriction of operations within the bounds of a memory buffer' class) in the HTTP request handler of the Tenda WH450 web management interface. The affected endpoint, /goform/VirtualSer, is the virtual-server / port-forwarding configuration handler, and the vulnerable input is the 'page' argument, which is copied into a fixed-size stack buffer without adequate length validation. 'Goform' endpoints are characteristic of the embedded GoAhead/Realtek-style HTTP daemon commonly used in Tenda consumer routers, where CGI-style handlers parse form parameters directly from the request. Because the handler runs on the router's own embedded process, a crafted oversized 'page' value can overwrite adjacent stack memory such as saved return addresses, which typically manifests first as a denial-of-service (daemon or device crash/reboot) and, with a carefully constructed payload, could be leveraged for code execution in the context of the web server process. The provided CPE, cpe:2.3:o:tenda:wh450_firmware:1.0.0.18, confirms the affected target is the firmware image (not a separate application) at version 1.0.0.18. The CVSS 4.0 vector (PR:H, UI:N, AT:N) indicates that exploitability hinges on holding a high-privilege session - i.e., administrative credentials to the router's web UI - and does not require any victim interaction or special attack conditions.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable HTTP endpoint (AV:N) with low complexity (AC:L); PR:H retained per vendor vector since the config endpoint implies an authenticated admin session; buffer overflow yields full code execution, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Executive ViewAI
A high-severity buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) allows anyone holding an administrative session on the device's web management interface to crash it or potentially run their own code on it. Publicly available exploit code exists, so any internet- or network-exposed WH450 whose admin credentials are weak, shared, or reused is at meaningful risk of full compromise of that device. Because no vendor patch has been identified, leadership should treat every deployed WH450 as unpatched and decide whether these units belong in the environment at all.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or block network access to the router's HTTP management interface from untrusted networks, disable WAN-side remote administration, enforce unique strong administrative credentials with multi-factor where supported, restrict management to a dedicated segmented VLAN with no route to internal systems, and monitor for anomalous or oversized requests to /goform/VirtualSer and for unexpected device crashes or reboots.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB