Tenda WH450
CVE-2025-15180
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliveryAuthenticate to management UI
-
ExploitSend crafted request to /goform/webExcptypemanFilte with oversized 'page'
-
ExecutionOverflow stack buffer in HTTP handler
-
ImpactExecute attacker-controlled code / crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the /goform/webExcptypemanFilte endpoint of the Tenda WH450 (firmware 1.0.0.18) HTTP management interface, triggered by manipulating the 'page' argument to overflow a stack buffer. Per the CNA CVSS vector (PR:H), the attacker must first hold privileged/authenticated access to the web interface, which is the primary limiting factor; exploitation also requires network reachability of the router's administrative HTTP service, which on a SOHO device is typically LAN-side and not internet-exposed by default. Note the description itself does not state an authentication prerequisite, so the PR:H gating should be verified against the firmware - if the endpoint is actually reachable pre-auth, real-world exposure is higher than the vendor vector implies. |
| Impact | This is a stack-based buffer overflow (CWE-119) in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18), reachable via the 'page' argument of /goform/webExcptypemanFilte. Signals are mixed. The CNA-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 7.3 and treats the flaw as network-reachable with low complexity but requiring high privileges, yielding full confidentiality/integrity/availability impact on the device itself (no scope change). A public PoC exists (E:P), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread active exploitation. The PR:H choice is notable and arguably conservative: many Tenda /goform endpoints are exploitable with only low or default credentials, and the raw description states nothing about authentication - this is a conflict between the vendor vector and typical real-world exposure that should be verified against the actual firmware. Net assessment: a genuine code-execution-class bug with a working PoC, but confined to a low-prevalence consumer/SOHO device and gated (per the vendor) behind authentication, making it a moderate, opportunistic priority rather than a mass-exploitation emergency - prioritize for anyone operating WH450 units exposed to untrusted networks. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface (and, per the CVSS vector, valid/privileged credentials) sends a crafted HTTP request to /goform/webExcptypemanFilte with an overlong or malformed 'page' parameter, overflowing a stack buffer in the request handler. A publicly available PoC demonstrates the overflow, which can crash the service or be developed into arbitrary code execution on the embedded device. Exploitation is remote over the network with low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an attacker who can reach the device's administrative web service and supply a crafted 'page' argument to the /goform/webExcptypemanFilte endpoint to corrupt stack memory and potentially achieve arbitrary code execution with the privileges of the web server process. Per the vendor-supplied CVSS 4.0 vector (PR:H), the attacker must first hold privileged/authenticated access to the web interface, a requirement that significantly limits real-world exposure, though the endpoint's true pre-authentication reachability should be verified against the firmware. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no indication of confirmed active exploitation in the wild, and no vendor patch or advisory has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed firmware version is cited in the available references, so remediation must initially rely on compensating controls. Restrict the router's HTTP management interface to trusted LAN segments only, ensure remote/WAN administration is disabled, block inbound access to the management ports at the network edge, and change any default administrator credentials so that the PR:H authenticated-access prerequisite is not trivially satisfied; each of these limits exposure but does not remove the underlying flaw and will not help if an attacker already has a foothold on the LAN. Network monitoring or an IPS signature targeting malformed requests to /goform/webExcptypemanFilte can detect exploitation attempts but is bypassable and adds management overhead. If a patched firmware release becomes available from Tenda (monitor https://www.tenda.com.cn/), apply it immediately; otherwise, given the publicly available proof-of-concept code (https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/webExcptypemanFilter/webExcptypemanFilter.md), consider replacing the device or isolating it behind a dedicated VLAN as the most reliable long-term mitigation, accepting the cost and complexity of hardware replacement.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper restriction of operations within the bounds of a memory buffer, manifesting specifically as a stack-based buffer overflow (CWE-121 subtype behavior) in the HTTP request-handling component of the Tenda WH450 firmware revision 1.0.0.18. The affected element is the /goform/webExcptypemanFilte handler, which processes the 'page' parameter; because the input is copied into a fixed-size stack buffer without adequate length validation, an oversized value overwrites adjacent stack memory, including saved registers and the return address, giving the attacker control over execution flow if the overflow is weaponized. The CPE cpe:2.3:o:tenda:wh450_firmware:1.0.0.18 confirms the vulnerability is tied to the firmware image of this specific SOHO router model rather than to a separate software library. This class of bug is common in embedded router web management daemons that favor compact C string handling (strcpy/sprintf-style) over bounded copy primitives, and it is exposed through the same administrative HTTP surface used for configuration. The vendor CVSS 4.0 vector reports AV:N/AC:L/AT:N with PR:H, meaning exploitation requires authenticated privileged access and no special preconditions, while the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impact as High across the board, consistent with full device compromise as the likely worst case.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform handler with low complexity and full device compromise; I assess PR:L rather than the vendor's PR:H because such Tenda endpoints commonly need only low/default credentials, not administrative privilege.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HTTP Request Handler. Such manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.
Executive ViewAI
The Tenda WH450 router running firmware 1.0.0.18 is affected by a high-severity buffer overflow in its administrative web interface that could let a privileged/authenticated attacker execute code with web server privileges. Publicly available exploit code exists and no vendor-released patch identified at time of analysis, so organizations with these devices exposed to untrusted networks or shared administrative access face potential network compromise, service disruption, and lateral movement risk. Leadership should prioritize inventory, exposure reduction, and replacement planning because the device may remain unpatchable in the near term.
No vendor-released patch identified at time of analysis; interim mitigations include disabling the HTTP management interface where not required, restricting it to trusted management networks/VPN, blocking WAN access, enforcing least-privilege unique admin credentials and MFA if supported, monitoring or blocking requests to /goform/webExcptypemanFilte, segmenting affected Tenda WH450 firmware 1.0.0.18 devices, and planning replacement or compensating firewall/IPS controls. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB