CVE-2025-14665
📋 TL;DR
A remote stack-based buffer overflow vulnerability in Tenda WH450 routers allows attackers to execute arbitrary code by sending specially crafted HTTP requests to the /goform/DhcpListClient endpoint. This affects Tenda WH450 router users running firmware version 1.0.0.18. The vulnerability has a CVSS score of 9.8, indicating critical severity.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to connected devices, and botnet recruitment.
Likely Case
Router takeover allowing attackers to modify DNS settings, intercept credentials, disable security features, and use the device for DDoS attacks.
If Mitigated
Limited impact if device is behind firewall with strict inbound rules, though internal network compromise remains possible if attacker gains initial access.
🎯 Exploit Status
Public proof-of-concept code is available showing exploitation via HTTP POST requests with crafted 'page' parameter. The exploit requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via web interface. 3. If no update, consider replacing device with supported model.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda WH450 routers from internet and critical internal networks
Access Control Lists
allBlock external access to router web interface (port 80/TCP)
iptables -A INPUT -p tcp --dport 80 -j DROP
netsh advfirewall firewall add rule name="Block Tenda Web" dir=in action=block protocol=TCP localport=80
🧯 If You Can't Patch
- Replace affected Tenda WH450 routers with different models that receive security updates
- Deploy network monitoring to detect exploitation attempts and isolate compromised devices
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://router-ip/ or using command: curl -s http://router-ip/ | grep -i 'firmware'Check Version:
curl -s http://router-ip/ | grep -o 'Firmware Version:[^<]*' || echo 'Check web interface manually'Verify Fix Applied:
Verify firmware version is no longer 1.0.0.18. Test with vulnerability scanner if available.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/DhcpListClient with abnormal 'page' parameter values
- Router reboot events or configuration changes
Network Indicators:
- Unusual outbound connections from router IP
- DNS queries to suspicious domains from router
SIEM Query:
source="router.log" AND (url="/goform/DhcpListClient" OR method="POST" AND uri CONTAINS "DhcpListClient")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/DhcpListClient/DhcpListClient.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/DhcpListClient/DhcpListClient.md#reproduce
- https://vuldb.com/?ctiid.336397
- https://vuldb.com/?id.336397
- https://vuldb.com/?submit.714400
- https://vuldb.com/?submit.719220
- https://www.tenda.com.cn/
