CVE-2025-15048 Tenda WH450 HTTP Request CheckTools command injection

Medium 6.9 Published 23 Dec 2025 Updated 24 Feb 2026

Remote attackers can execute arbitrary commands on Tenda WH450 routers via the CheckTools HTTP handler due to improper input validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-15048?

CVE-2025-15048 is a medium-severity command injection vulnerability in Tenda WH450, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Weakness: CWE-77, CWE-74

Which versions are affected by CVE-2025-15048?

It affects 1 product.

Products include Tenda Wh450 Firmware.

How do I fix CVE-2025-15048?

No fix has been published for CVE-2025-15048 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-15048 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15048 exists.

Sources

Also known as GHSA-g29r-xm3q-hxxv.