CVE-2025-14879
Published: 18 December 2025
Summary
CVE-2025-14879 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Wh450 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow vulnerability by applying firmware patches from the vendor.
Enforces validation of the ssid_index argument in the HTTP request handler to prevent buffer overflow exploitation.
Implements memory protections such as stack canaries and non-executable stacks to mitigate stack-based buffer overflow attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the unauthenticated web interface (/goform/onSSIDChange) of the Tenda WH450 router enables remote exploitation of a public-facing application (T1190) for arbitrary code execution and application/system denial of service via crash (T1499.004). Public PoC available.
NVD Description
A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler. This manipulation of the argument ssid_index causes stack-based buffer overflow. It is possible to initiate the…
more
attack remotely. The exploit has been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2025-14879 is a stack-based buffer overflow vulnerability affecting the Tenda WH450 router on firmware version 1.0.0.18. The flaw resides in an unknown function within the /goform/onSSIDChange file of the HTTP Request Handler component, where manipulation of the ssid_index argument triggers the overflow. It is associated with CWEs-119 and CWE-121.
Attackers can exploit this vulnerability remotely over the network without authentication or user interaction, requiring only low attack complexity. Successful exploitation grants high impacts across confidentiality, integrity, and availability (CVSS v3.1 base score of 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), potentially allowing arbitrary code execution on the device.
A proof-of-concept exploit is publicly available on GitHub (https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/onSSIDChange/onSSIDChange.md), and further details appear in VulDB entries (https://vuldb.com/?ctiid.337370, https://vuldb.com/?id.337370, https://vuldb.com/?submit.715362). Practitioners should monitor the Tenda website (https://www.tenda.com.cn/) for firmware patches or mitigation guidance, as the public PoC increases the risk of active attacks.
Details
- CWE(s)