CVE-2025-15048
Published: 23 December 2025
Description
A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be launched…
more
remotely. The exploit has been publicly disclosed and may be utilized.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating the ipaddress argument in HTTP requests to the /goform/CheckTools endpoint.
Remediates the specific command injection flaw in Tenda WH450 firmware version 1.0.0.18 through timely patching or updates.
Monitors and controls remote HTTP traffic to the vulnerable endpoint, blocking or detecting exploit attempts at the network boundary.
Security SummaryAI
CVE-2025-15048 is a command injection vulnerability in Tenda WH450 firmware version 1.0.0.18. It affects an unknown function in the /goform/CheckTools file within the HTTP Request Handler component, where manipulation of the ipaddress argument triggers the issue. The vulnerability is classified under CWE-74 and CWE-77, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability without requiring privileges or user interaction. By sending a specially crafted HTTP request to the vulnerable endpoint, they can inject and execute arbitrary commands on the device, achieving limited impacts on confidentiality, integrity, and availability.
Advisories and references, including VulDB entries (ctiid.337853, id.337853, submit.720885), document the vulnerability details and submission. GitHub repositories provide proof-of-concept code, including reproduction steps, confirming the exploit has been publicly disclosed and may be utilized by attackers. No specific patches or mitigations are detailed in the available information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in the router's public-facing web interface (/goform/CheckTools) enables exploitation of public-facing application (T1190) for indirect command execution (T1202).