Tenda WH450
CVE-2025-15046
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend crafted POST to /goform/PPTPClient
-
ExploitOverflow stack buffer via oversized netmsk
-
ExecutionOverwrite saved return address
-
ImpactExecute arbitrary code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the device's HTTP management interface and issue a request to the /goform/PPTPClient endpoint (the PPTP client configuration handler) with a malicious 'netmsk' parameter value; per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed against Tenda WH450 firmware 1.0.0.18. The practical limiting factor is network position: SOHO router web management is commonly bound to the LAN interface, so internet-wide exploitation depends on remote/WAN management being enabled or the device being otherwise exposed - this is not confirmed in the provided data and should be verified. No patched firmware version is identified in the references. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity, and availability of the device, scoring 8.9 - a genuinely severe technical profile for a stack-based buffer overflow (CWE-119) in a router's HTTP request handler. The vector's E:P (Proof-of-Concept) exploit maturity is corroborated by the included GitHub PoC reference, so exploit code demonstrably exists. However, several signals temper real-world priority: there is NO EPSS score provided in the input, NO CISA KEV listing, and the reporting source is VulDB (cna@vuldb.com), a database that mass-registers low-end IoT/router bugs often without independent vendor confirmation. No official Tenda advisory or patch is present in the references (only the vendor homepage), so fix availability is unknown. This pattern - a high CVSS on an obscure consumer router with a public PoC but no KEV and no EPSS - typically indicates opportunistic/targeted risk (e.g., IoT botnet recruitment of exposed devices) rather than confirmed widespread active exploitation. Note a consistency caveat: the description says 'launch the attack remotely' and CVSS asserts AV:N, but many Tenda /goform overflows are only reachable from the LAN-side web management interface; whether the WAN interface is exposed by default is not confirmed in the data - verify management-interface exposure before treating this as internet-wide. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface sends a crafted HTTP POST to /goform/PPTPClient with an oversized 'netmsk' argument, overflowing a fixed-size stack buffer in the request handler. A public proof-of-concept exists (GitHub, z472421519/BinaryAudit), lowering the bar to reproduce the crash and potentially achieve arbitrary code execution or denial of service on the device. Because CVSS indicates no authentication (PR:N) and low complexity (AC:L), exploitation is straightforward wherever the management interface is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory, crash the device, and potentially execute code by sending a crafted netmsk value to the /goform/PPTPClient HTTP endpoint; the CVSS 4.0 vector scores 8.9 with no privileges or user interaction required. Publicly available exploit code exists in a GitHub BinaryAudit proof-of-concept, so the flaw is easy to reproduce, though real-world exposure depends on whether the router's management interface is reachable from the attacker's network. Practical exploitation is often limited because SOHO router web management is commonly bound to the LAN interface unless remote/WAN management has been enabled.
RemediationAI
No vendor-released patch was identified at time of analysis, so owners of Tenda WH450 firmware 1.0.0.18 should apply compensating controls immediately. Disable remote/WAN management and any UPnP port mapping that exposes the router's web interface, and restrict administrative access to a trusted LAN or management VLAN via firewall allowlists; this reduces internet-wide exposure but does not protect against attackers already on the LAN. If PPTP client functionality is not required, disable the PPTP client feature, accepting that PPTP-based WAN connections will no longer work. If the web UI must remain reachable, place it behind a reverse proxy or access-control layer that blocks or strictly limits requests to /goform/PPTPClient and rejects oversized netmsk values, with the trade-off that PPTP client configuration through the UI may break. Monitor the device for unexpected reboots, crashes, or anomalous HTTP requests to /goform/PPTPClient, and consider replacing or isolating the router if a fixed firmware release is not forthcoming. Reference the public PoC details at https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md and the VulDB entry at https://vuldb.com/?id.337851 for validation and vendor follow-up.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the HTTP request handler that processes PPTP client configuration on Tenda WH450 firmware 1.0.0.18, specifically the /goform/PPTPClient endpoint and its netmsk parameter. The root cause is CWE-119, improper restriction of operations within the bounds of a memory buffer: the handler copies attacker-controlled netmsk data into a fixed-size stack buffer without adequate length validation, producing a stack-based buffer overflow. The provided CPE identifies the exact affected platform as cpe:2.3:o:tenda:wh450_firmware:1.0.0.18:*:*:*:*:*:*:*. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), the endpoint is network reachable, low complexity, unauthenticated, and requires no user interaction; however, the practical limiting factor is network position, because the router's HTTP management interface is commonly bound to the LAN and internet-wide exploitation would require remote/WAN management to be enabled or the device to be otherwise exposed, which is not confirmed in the provided data. The public GitHub PoC demonstrates the overflow against the PPTPClient handler.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated (PR:N), low-complexity stack overflow reachable over the network via the web handler, enabling code execution with full C/I/A impact on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Tenda WH450 routers running firmware 1.0.0.18 contain a remotely triggerable memory-corruption flaw in the device's web management interface that can crash the unit and may allow an attacker to run code on it. Because no vendor patch is available and proof-of-concept exploit code is public, any WH450 that has remote or WAN-side management enabled represents an unpatched, unauthenticated entry point into the network edge; leadership should treat internet-exposed units as an immediate operational risk.
No vendor patch is available; restrict the /goform management interface to a trusted LAN or management VLAN, disable WAN/remote web administration and any port forwards to the device, segment or replace internet-exposed units, and monitor device logs and reboot behavior for signs of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB