CVE-2025-15180
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote attackers to execute arbitrary code by sending specially crafted HTTP requests to the /goform/webExcptypemanFilte endpoint. This affects Tenda WH450 router users running firmware version 1.0.0.18. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and botnet recruitment.
If Mitigated
Denial of service or router crash requiring physical reset.
🎯 Exploit Status
Public proof-of-concept demonstrates exploitation; simple HTTP request manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check Tenda website for firmware updates. If update available: 1. Download firmware from Tenda support site. 2. Log into router admin interface. 3. Navigate to firmware upgrade section. 4. Upload and apply new firmware. 5. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Log into router admin → System Tools → Remote Management → Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to router IP on ports 80/443
🧯 If You Can't Patch
- Replace affected Tenda WH450 router with a different model or vendor
- Implement strict network access controls to limit who can reach the router's management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 1.0.0.18 after update📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/webExcptypemanFilte with unusual parameters
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to router IP with long 'page' parameter values
- Unusual traffic patterns from router
SIEM Query:
source="router_logs" AND uri="/goform/webExcptypemanFilte" AND (param_length(page) > 100 OR status=500)🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/webExcptypemanFilter/webExcptypemanFilter.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/webExcptypemanFilter/webExcptypemanFilter.md#reproduce
- https://vuldb.com/?ctiid.338565
- https://vuldb.com/?id.338565
- https://vuldb.com/?submit.721219
- https://www.tenda.com.cn/
