Cyber Posture

CVE-2025-15048

HighPublic PoC

Published: 23 December 2025

Published
23 December 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0025 48.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be launched…

more

remotely. The exploit has been publicly disclosed and may be utilized.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents command injection by validating the ipaddress argument in HTTP requests to the /goform/CheckTools endpoint.

prevent

Remediates the specific command injection flaw in Tenda WH450 firmware version 1.0.0.18 through timely patching or updates.

preventdetect

Monitors and controls remote HTTP traffic to the vulnerable endpoint, blocking or detecting exploit attempts at the network boundary.

Security SummaryAI

CVE-2025-15048 is a command injection vulnerability in Tenda WH450 firmware version 1.0.0.18. It affects an unknown function in the /goform/CheckTools file within the HTTP Request Handler component, where manipulation of the ipaddress argument triggers the issue. The vulnerability is classified under CWE-74 and CWE-77, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Remote attackers can exploit this vulnerability without requiring privileges or user interaction. By sending a specially crafted HTTP request to the vulnerable endpoint, they can inject and execute arbitrary commands on the device, achieving limited impacts on confidentiality, integrity, and availability.

Advisories and references, including VulDB entries (ctiid.337853, id.337853, submit.720885), document the vulnerability details and submission. GitHub repositories provide proof-of-concept code, including reproduction steps, confirming the exploit has been publicly disclosed and may be utilized by attackers. No specific patches or mitigations are detailed in the available information.

Details

CWE(s)

Affected Products

tenda
wh450 firmware
1.0.0.18

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

Unauthenticated remote command injection in the router's public-facing web interface (/goform/CheckTools) enables exploitation of public-facing application (T1190) for indirect command execution (T1202).

References