CVE-2025-15179
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda WH450 router firmware version 1.0.0.18 allows remote attackers to execute arbitrary code by manipulating the 'page' parameter in the /goform/qossetting endpoint. This affects all users running the vulnerable firmware version on their Tenda WH450 routers. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router crash/reboot causing temporary network disruption, or limited code execution allowing attacker persistence on the device.
If Mitigated
Denial of service from failed exploitation attempts or limited impact if proper network segmentation isolates the router.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda official website for firmware updates. 2. Download latest firmware for WH450. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Implement strict firewall rules blocking all external access to router management interface (ports 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: Login > System Tools > Firmware Version. If version is 1.0.0.18, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep version (if API available)Verify Fix Applied:
Verify firmware version has changed from 1.0.0.18 to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/qossetting with large 'page' parameter values
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- Unusual traffic patterns to router management interface
- POST requests to /goform/qossetting from external IPs
- Buffer overflow patterns in HTTP requests
SIEM Query:
source="router_logs" AND (url="/goform/qossetting" OR message="*buffer overflow*" OR message="*segmentation fault*")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/qossetting/qossetting.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/qossetting/qossetting.md#reproduce
- https://vuldb.com/?ctiid.338564
- https://vuldb.com/?id.338564
- https://vuldb.com/?submit.721218
- https://www.tenda.com.cn/
