CVE-2025-15177
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability has been found in Tenda WH450 1.0.0.18. The HTTP Request Handler component, specifically the file /goform/SetIpBind, is affected. Manipulation of the page argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been disclosed to the public.
Risk Assessment
A remote attacker could exploit this vulnerability to execute code or crash the device, potentially compromising network security.
Recommendation
Update the Tenda WH450 firmware to the latest version and secure the administrative interface.
Other vulnerabilities in Tenda WH450
See all- CVE-2025-15046Critical
A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-15045Critical
A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler. This manipulation of the argument page causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
- CVE-2025-15044Critical
A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
- CVE-2025-15010Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown processing in the file /goform/SafeUrlFilter. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15007Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown functionality in the file /goform/L7Im of the HTTP Request Handler component. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2023-39672Critical
Version 1.0.0.18 of the Tenda WH450 has a buffer overflow vulnerability in the fgets function.
- CVE-2025-15180High
Tenda WH450 version 1.0.0.18 has a stack-based buffer overflow vulnerability in the /goform/webExcptypemanFilte function. Manipulation of the page argument can lead to buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2025-15179High
Tenda WH450 version 1.0.0.18 has a stack-based buffer overflow vulnerability in the /goform/qossetting function. Manipulation of the page argument causes buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-15178High
A vulnerability was found in Tenda WH450 1.0.0.18. The HTTP Request Handler component, specifically the file /goform/VirtualSer, is affected. Manipulation of the page argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been made public.
- CVE-2025-15163High
A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

