CVE-2025-15010
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Tenda WH450 routers version 1.0.0.18, specifically in the /goform/SafeUrlFilter endpoint. Remote attackers can exploit this to execute arbitrary code or crash the device. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement to internal networks.
Likely Case
Device crash causing denial of service, potential credential theft, and network disruption.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept demonstrates exploitation. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download and install the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the router's web interface
Access router admin panel → Advanced Settings → Remote Management → Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login → System Status → Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 1.0.0.18 after update📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/SafeUrlFilter with unusual parameters
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to /goform/SafeUrlFilter with long 'page' parameter
- Unexpected traffic from router to external IPs
SIEM Query:
source="router_logs" AND (url="/goform/SafeUrlFilter" OR "buffer overflow" OR "segmentation fault")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/SafeUrlFilter/SafeUrlFilter.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/SafeUrlFilter/SafeUrlFilter.md#reproduce
- https://vuldb.com/?ctiid.337716
- https://vuldb.com/?id.337716
- https://vuldb.com/?submit.719219
- https://www.tenda.com.cn/
