CVE-2025-15162
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote attackers to execute arbitrary code by manipulating the 'page' parameter in the /goform/RouteStatic endpoint. This affects Tenda WH450 routers running firmware version 1.0.0.18. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Remote code execution resulting in device takeover, credential theft, network traffic interception, and denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exists on GitHub demonstrating the buffer overflow. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Navigate to firmware upgrade section 5. Upload and apply new firmware 6. Reboot router
🔧 Temporary Workarounds
Network Access Control
allBlock external access to router web interface and restrict internal access to trusted IPs only
Firewall Rules
allImplement firewall rules to block access to port 80/443 on affected routers from untrusted networks
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict access controls
- Implement network monitoring for exploitation attempts targeting /goform/RouteStatic endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 1.0.0.18, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Upgrade sectionVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.0.18📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/RouteStatic with unusual page parameter values
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to /goform/RouteStatic with crafted page parameters
- Unusual traffic patterns from router IP
SIEM Query:
source="router_logs" AND (uri="/goform/RouteStatic" OR message="buffer overflow" OR message="crash")