Critical · published December 22, 2025
🚨 A stack-based buffer overflow in Tenda WH450 could let an attacker hijack your device, all by tampering with a single URL filter! 🔥 Think of it like a restaurant chef who blindly follows a recipe without checking the ingredients. If a rogue cook slipped in a dangerous item, the whole dish could get messed up — and the same goes for this device when it processes the wrong input! An attacker exploiting this vulnerability could gain remote access to your router, allowing them to execute arbitrary code and seize control of your network. The potential consequences are absolutely devastating, as it could lead to data theft, unauthorized monitoring, or even further attacks on other devices connected to your network!
Think of it like a restaurant chef who blindly follows a recipe without checking the ingredients. If a rogue cook slipped in a dangerous item, the whole dish could get messed up — and the same goes for this device when it processes the wrong input! This vulnerability results from insufficient validation in the `/goform/SafeUrlFilter` file, allowing an attacker to manipulate the `page` argument, triggering a buffer overflow. This results in the possibility of remote code execution without authentication.
An attacker exploiting this vulnerability could gain remote access to your router, allowing them to execute arbitrary code and seize control of your network. The potential consequences are absolutely devastating, as it could lead to data theft, unauthorized monitoring, or even further attacks on other devices connected to your network! Immediate action is crucial! Update to the patched version of Tenda WH450 as soon as it becomes available to close this serious gap. Until then, consider disabling remote access features and limit exposure on your network. 🛡️ You've got this! Stay vigilant and proactive, and you'll keep your network safe from lurking threats! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| tenda/wh450_firmware | all versions | — |