by Kastro
Paper/Archive/CVE-2025-14879

CVE-2025-14879

Tenda WH450 — Tenda WH450 HTTP Request onSSIDChange stack-based overflow

EPSS 7%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.9.939 × 2018.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler. This manipulation of the argument ssid_index causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected

ProductAffectedFixed inSource
WH4501.0.0.18–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.337370refvuldb.com/?ctiid.337370writeupvuldb.com/?submit.715362exploitgithub.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/onSSIDChange/onSSIDChange.mdreftenda.com.cn