Tenda WH450 CVE-2025-15179

Exploitation targets the QoS configuration endpoint /goform/qossetting, triggered by supplying a crafted/oversized value to the 'page' argument. Per the CVSS vector (PR:H), the attacker must hold administrative/authenticated access to the router's web management interface, which is the primary limiting factor. A further practical limit is network exposure: router management UIs are normally reachable only from the LAN, so remote (WAN) exploitation realistically requires the admin interface to be internet-exposed or the attacker to already be on the local network. No special non-default configuration of the QoS feature is stated as required by the description.

This is a medium-to-high severity stack-based buffer overflow (CWE-119) in the Tenda WH450 router's /goform/qossetting handler, carrying a vendor (VulDB) CVSS 4.0 base score of 7.3. Weighing the signals: the CVSS vector indicates network vector with low attack complexity (AV:N/AC:L) and no user interaction, but notably requires high privileges (PR:H), meaning an authenticated administrator is assumed. Exploit maturity is Proof-of-Concept (E:P), and a POC is publicly available on GitHub, so this qualifies as 'publicly available exploit code exists' - but there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active, widespread exploitation. The real-world risk is tempered by two factors that should be verified: (1) the PR:H requirement means an attacker must already be authenticated to the router admin interface, which substantially raises the bar versus a pre-auth flaw; and (2) AV:N is optimistic for a SOHO router whose management interface is typically LAN-bound rather than internet-facing - verify actual exposure. The impact if exploited is serious (VC:H/VI:H/VA:H → full code execution/device compromise), but the combination of required authentication, PoC-only maturity, and a niche consumer product means this is a moderate-priority issue rather than an emergency, unless the device's web UI is exposed to untrusted networks or protected only by default credentials.

An attacker with access to the WH450 web management interface (e.g., on the LAN, or via exposed/default admin credentials) sends a crafted request to /goform/qossetting with an oversized 'page' argument, overflowing a stack buffer. Because low-cost routers often lack stack protections, this can be leveraged to crash the device or execute arbitrary code, yielding full control of the router. A public proof-of-concept documenting the overflow and reproduction steps is available on GitHub.