CVE-2025-15010
Stack-Based Buffer Overflow in Tenda WH450 /goform/SafeUrlFilter
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | wh450 | 1.0.0.18 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-15010 is a critical stack-based buffer overflow vulnerability in the Tenda WH450 router firmware version 1.0.0.18. It occurs due to improper processing of the 'page' argument in the /goform/SafeUrlFilter endpoint. By sending a specially crafted HTTP request with an excessively long 'page' parameter, an attacker can trigger a stack-based buffer overflow. This flaw allows remote attackers to potentially execute arbitrary code or cause a denial of service without any authentication. [2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact the affected device by allowing remote attackers to execute arbitrary code, leading to full compromise of the router. It can also cause denial of service conditions, disrupting network availability. Since exploitation requires no authentication and a proof-of-concept exploit is publicly available, the risk of attack is high. The vulnerability affects confidentiality, integrity, and availability of the device, potentially allowing attackers to intercept, modify, or disrupt network traffic. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the /goform/SafeUrlFilter endpoint, specifically looking for unusually long or malformed 'page' parameter values that could trigger the stack-based buffer overflow. Since the exploit involves sending crafted HTTP requests, network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on suspicious requests targeting this endpoint. Commands such as using curl or wget to test the endpoint with long 'page' parameter values can help verify if the system is vulnerable. For example: curl -v 'http://<router-ip>/goform/SafeUrlFilter?page=' followed by a long string of characters. Additionally, network traffic capture tools like tcpdump or Wireshark can be used to analyze traffic for such exploit attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Currently, there are no known mitigations or countermeasures available for this vulnerability. The recommended immediate step is to replace the affected Tenda WH450 device with an alternative product to avoid exploitation. Until a patch or firmware update is released by the vendor, restricting network access to the device, disabling remote management, or isolating the device from untrusted networks may reduce exposure but do not fully mitigate the risk. [2]