CVE-2025-15048
Published: 23 December 2025
Summary
CVE-2025-15048 is a high-severity Injection (CWE-74) vulnerability in Tenda Wh450 Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating the ipaddress argument in HTTP requests to the /goform/CheckTools endpoint.
Remediates the specific command injection flaw in Tenda WH450 firmware version 1.0.0.18 through timely patching or updates.
Monitors and controls remote HTTP traffic to the vulnerable endpoint, blocking or detecting exploit attempts at the network boundary.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in the router's public-facing web interface (/goform/CheckTools) enables exploitation of public-facing application (T1190) for indirect command execution (T1202).
NVD Description
A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be launched…
more
remotely. The exploit has been publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2025-15048 is a command injection vulnerability in Tenda WH450 firmware version 1.0.0.18. It affects an unknown function in the /goform/CheckTools file within the HTTP Request Handler component, where manipulation of the ipaddress argument triggers the issue. The vulnerability is classified under CWE-74 and CWE-77, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without requiring privileges or user interaction. By sending a specially crafted HTTP request to the vulnerable endpoint, they can inject and execute arbitrary commands on the device, achieving limited impacts on confidentiality, integrity, and availability.
Advisories and references, including VulDB entries (ctiid.337853, id.337853, submit.720885), document the vulnerability details and submission. GitHub repositories provide proof-of-concept code, including reproduction steps, confirming the exploit has been publicly disclosed and may be utilized by attackers. No specific patches or mitigations are detailed in the available information.
Details
- CWE(s)