CVE-2025-15048
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Tenda WH450 routers by injecting malicious input into the 'ipaddress' parameter of the HTTP request handler. Attackers can exploit this without authentication to gain control of affected devices. Users running Tenda WH450 firmware version 1.0.0.18 are affected.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept network traffic, install persistent backdoors, pivot to internal networks, or use the device for botnet activities.
Likely Case
Remote code execution leading to router compromise, credential theft, DNS hijacking, and network surveillance.
If Mitigated
Limited impact if network segmentation isolates the router and external access is restricted.
🎯 Exploit Status
Public proof-of-concept demonstrates command injection via crafted HTTP requests to /goform/CheckTools endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download and install the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Block External Access
allPrevent external access to the router's web interface by configuring firewall rules to block inbound HTTP/HTTPS traffic to the router from untrusted networks.
Network Segmentation
allIsolate the router on a separate VLAN to limit potential lateral movement if compromised.
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network monitoring and intrusion detection for suspicious HTTP requests to /goform/CheckTools
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System Tools. If version is 1.0.0.18, the device is vulnerable.Check Version:
Not applicable - check via router web interfaceVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.0.18.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/CheckTools with unusual ipaddress parameters containing shell metacharacters
- Unusual command execution in router logs
Network Indicators:
- HTTP POST requests to /goform/CheckTools with command injection payloads in ipaddress parameter
- Outbound connections from router to unexpected destinations
SIEM Query:
http.url:"/goform/CheckTools" AND http.param.ipaddress:("|" OR ";" OR "&" OR "`" OR "$")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/CMD/Tenda_WH450/CheckTools/CheckTools.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/CMD/Tenda_WH450/CheckTools/CheckTools.md#reproduce
- https://vuldb.com/?ctiid.337853
- https://vuldb.com/?id.337853
- https://vuldb.com/?submit.720885
- https://www.tenda.com.cn/
