CVE-2025-15164
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote attackers to execute arbitrary code by manipulating the 'page' parameter in the /goform/SafeMacFilter endpoint. This affects Tenda WH450 router users running firmware version 1.0.0.18. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and lateral movement into connected networks.
Likely Case
Router compromise leading to denial of service, configuration changes, or installation of persistent malware.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access or if exploit attempts are blocked by network security controls.
🎯 Exploit Status
Public PoC available on GitHub, remote exploitation without authentication, simple buffer overflow technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel -> System -> Remote Management -> Disable
Network Segmentation
linuxIsolate router management interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected router with different model/vendor
- Place router behind firewall with strict inbound rules blocking all WAN access to management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 1.0.0.18 after update📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/SafeMacFilter with long page parameter
- Router crash/reboot logs
- Unusual configuration changes
Network Indicators:
- HTTP POST requests to /goform/SafeMacFilter with oversized page parameter
- Traffic from external IPs to router management ports
SIEM Query:
source="router.log" AND (uri="/goform/SafeMacFilter" AND method="POST" AND content_length>1000)