CVE-2025-15008 is a high severity stack based buffer overflow (CVSS 7.3) in the HTTP request handler of the Tenda WH450, firmware 1.0.0.18. The page argument to /goform/L7Port is involved. The record lists no fix, so restrict the admin interface and watch Tenda's support page.
What's affected
The record names the Tenda WH450 at firmware version 1.0.0.18. The affected element is an unknown part of /goform/L7Port, in the HTTP Request Handler component, and the argument is page.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Network reachable, low complexity, no privileges and no user interaction, per the vector.
- Impact is scored low for each of confidentiality, integrity and availability.
- Fixed version: none listed in the record.
- Exploitation in the wild: not in CISA KEV. The record says the exploit is public.
A public write up on GitHub is linked from the record. This post does not reproduce its details.
How to check if you're exposed
Open the router's admin page and read the model and firmware version. If it is a WH450 on 1.0.0.18, it matches the record. The record does not say whether other builds are affected, so a different version is not proof of safety.
Then check exposure. The question is whether the web interface can be reached from places you do not control.
# From a machine on the WAN side, or an external scanner you control:
# does the router answer on its web management port?
curl -sI --max-time 5 http://203.0.113.10/ | head -n 5
Use your own router's public address instead of the sample one. Only test devices you own.
Also check whether remote management is enabled in the router settings.
What to do now
- List every Tenda WH450 you own or support, with firmware version.
- Disable remote management from the internet.
- Limit the admin interface to a trusted host or segment.
- Visit Tenda's support site for a firmware update. The record lists none, so confirm before you plan around one.
- Change the router's admin password to a unique one.
- Segment the router from sensitive systems.
- If no fix arrives and the device is exposed by design, replace it.
Why it matters
The weakness is CWE-121, stack based buffer overflow, under CWE-119, improper restriction of operations within the bounds of a memory buffer. A request handler copies data into a fixed size area on the stack without checking the length, and the extra data overwrites what lies beyond it. In the best case the device crashes. In the worst case the behavior of the program changes.
Embedded web servers on routers often run as the most privileged user on the device and are written in languages without memory safety. That combination makes buffer overflows a recurring pattern in this class of product, and firmware updates for small office gear are slow or absent.
Quick check
Is there a Tenda firmware update for CVE-2025-15008?
The record lists no fixed version. Check Tenda's support site for the WH450 and confirm in the release notes that the update names this CVE or the L7Port handler.
What is the quickest risk reduction?
Turn off remote management and limit the admin page to a trusted network. Both cut off the network path the vector assumes.
Sources
Last reviewed: 19 October 2026.
