CVE-2025-15048: High Command Injection in Tenda WH450 Router

CVE-2025-15048 is a high severity OS command injection flaw in the Tenda WH450 router, version 1.0.0.18. The ipaddress argument to /goform/CheckTools is passed on unsafely. NVD scores it 7.3. No fix is named, so reduce exposure of the admin interface.

What's affected

The record lists Tenda WH450 firmware 1.0.0.18. The weak code is the handler for /goform/CheckTools in the HTTP Request Handler component, reached through the ipaddress argument. No fixed firmware version is named in the record or in the references we could read. Check the vendor's download and support pages for newer firmware, and treat any claim of a fix as unconfirmed until the vendor says which release carries it.

How to check if you're exposed

Read the firmware version from the router's admin page and compare it with the version above. Then check whether the admin interface answers from the internet.

nmap -Pn -p 80,443,8080,8443 YOUR_ROUTER_PUBLIC_IP

Run it from outside your network. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) shows the attack needs no account at all and no user interaction. Because no login is needed, a reachable admin page is the main risk factor. Also check whether a diagnostic page like the one named in the CVE is reachable from user networks.

What to do now

1. List every Tenda WH450 on your networks and record each firmware version.
2. Disable remote management from the WAN side and allow the admin page only from a trusted management network.
3. Set a long unique admin password and remove any default or shared logins.
4. Contact the vendor for a fixed firmware and apply it as soon as one is confirmed.
5. If no fix is offered, plan replacement with a supported device, and keep the unit away from sensitive network paths until then.
6. Watch the router for unexpected configuration changes, new processes or odd outbound traffic.

Why it matters

The weakness is CWE-77, command injection, shown in the record as OS command injection and grouped under CWE-74, injection. The device takes a value from a web form, then builds a system command from it. If the value is not checked, the router's shell can be asked to do more than the form intended.

Routers sit between your network and the internet, so code execution on one is serious. The record says the exploit is public. This CVE is not on the CISA KEV list, so the record shows no confirmed use in the wild. The scores in the record are modest (7.3), but low scores on edge devices often understate the value of the foothold.

Going further

Command injection in diagnostic pages is common in consumer and small office routers, because a ping or trace tool is an easy feature to add and an easy one to build unsafely. Even after a vendor fix, keep admin pages off the internet. That one control blocks most bugs in this family.

Add the router to the list of devices whose firmware you review each quarter. A single owner and a calendar reminder are enough.

Think about blast radius. If an attacker took control of the router, what could they see? Usually all outbound traffic, DNS settings and any unencrypted internal traffic that crosses it. Encrypting traffic end to end, using DNS you control and segmenting guest and office networks all reduce what a compromised router can give away.

Also decide who in your organisation owns edge devices. Advisories for routers often arrive by a vendor email or a researcher post, and nobody sees them if the device belongs to no team. A named owner and a simple inventory turn a CVE like this into a ten minute check.

For the software you build, the free in-browser dependency scan at https://gold.safeguard.sh/scan finds known vulnerable libraries. It does not read router firmware, so use the steps above for devices.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold record for CVE-2025-15048
• NVD entry for CVE-2025-15048
• Fetched reference on github.com

Last reviewed: 19 October 2026.