CVE-2025-15010
Published: 22 December 2025
Summary
CVE-2025-15010 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Wh450 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through firmware patching directly eliminates the stack-based buffer overflow in the /goform/SafeUrlFilter endpoint of Tenda WH450 1.0.0.18.
Validating the 'page' argument in information inputs prevents the manipulation that triggers the stack-based buffer overflow.
Memory protection mechanisms such as stack canaries and non-executable stacks mitigate exploitation of the stack-based buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated stack-based buffer overflow in router web endpoint /goform/SafeUrlFilter enables remote exploitation of public-facing application for potential RCE.
NVD Description
A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has…
more
been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-15010 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting Tenda WH450 routers on firmware version 1.0.0.18. The flaw occurs in an unknown processing component handling the /goform/SafeUrlFilter file, where manipulation of the "page" argument triggers the overflow.
The vulnerability enables remote exploitation over the network with low complexity, requiring no privileges or user interaction, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to full device compromise such as arbitrary code execution.
References point to a publicly disclosed proof-of-concept on GitHub, including reproduction steps for the SafeUrlFilter buffer overflow in Tenda WH450. VulDB advisories document the issue under CTI ID 337716, noting recent submission and public exploit availability that may facilitate active use. No patches are mentioned in the provided details.
Details
- CWE(s)