Tenda WH450
CVE-2025-15047
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface
-
DeliverySend crafted /goform/PPTPDClient request
-
ExploitOverflow Username stack buffer
-
ExecutionCorrupt saved return address
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the HTTP Request Handler endpoint /goform/PPTPDClient on Tenda WH450 firmware 1.0.0.18, triggered by supplying an oversized value in the Username argument; per the CVSS vector no authentication or user interaction is required (PR:N/UI:N). The principal limiting factor is network reachability of the device's web-management interface: on consumer/SOHO routers this is typically bound to the LAN, so practical exploitation requires an attacker already on the local network or a device whose admin interface has been deliberately exposed to the WAN. Exploitation is further constrained to the specific affected firmware build (1.0.0.18). |
| Impact | Signals are moderately consistent but point to a targeted rather than mass-exploitation profile. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), yielding the 8.9 base score, and public exploit code exists (E:P, confirmed by the GitHub PoC). However, this is NOT in CISA KEV and no EPSS probability was provided, so there is no evidence of active or widespread exploitation - PoC availability alone does not equal in-the-wild use. A key caveat: although PR:N claims unauthenticated access, the affected endpoint is a /goform web-management handler on a Tenda WH450 wireless device whose HTTP interface is normally LAN-facing, so real-world 'remote' reach typically requires an attacker already on the local network or a device with its management plane exposed to the WAN - verify exposure before treating this as internet-wide. CWE-119 (buffer errors) plus 'stack-based buffer overflow' is consistent with the high impact, but no vendor confirmation of code-execution reliability is available. Net: a genuinely serious bug for exposed/LAN-adjacent devices, but likely opportunistic/targeted rather than a broad priority given the niche product and absence of KEV/EPSS corroboration. |
| Exploit ScenarioDerived | An attacker with network access to the WH450's HTTP management interface (LAN-side, or WAN-side if the admin interface is exposed) sends a crafted HTTP request to /goform/PPTPDClient with an overlong Username argument, overflowing a stack buffer in the request handler. A public proof-of-concept exists, so exploitation requires no original research; a successful overflow can crash the device or potentially lead to arbitrary code execution on the embedded Linux firmware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corrupt memory through an oversized Username parameter, with assessed high impact on confidentiality, integrity, and availability. Exploitation requires reachability to the router’s web-management interface, which is typically LAN-bound, and the assessed vector indicates no authentication or user interaction is required. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the provided intelligence; monitor the Tenda vendor site at https://www.tenda.com.cn/ for a firmware update addressing CVE-2025-15047 and apply it when available. Until then, restrict exposure of the router’s web-management interface by disabling WAN/remote administration, which removes remote management capability but substantially reduces attack surface. Place the WH450 management interface on a trusted administrative VLAN and firewall it from guest, IoT, and untrusted LAN segments, accepting that administrators must use that trusted segment. If PPTP client configuration is not required, disable PPTP/VPN client functionality or block requests to /goform/PPTPDClient at an upstream reverse proxy or intrusion-prevention control, recognizing that legitimate PPTP client setup through the web UI will be unavailable. Monitor HTTP requests to /goform/PPTPDClient for oversized Username values and review the referenced GitHub PoC at https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md for detection guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda WH450 is a consumer/SOHO router whose web management interface exposes goform endpoints for device configuration. The /goform/PPTPDClient handler processes the Username argument used for PPTP client settings and copies it into a fixed-size stack buffer without adequate bounds checking, matching CWE-119 improper restriction of operations within the bounds of a memory buffer. The CPE identifies Tenda WH450 firmware 1.0.0.18 as the affected build; the CVSS:4.0 vector carries E:P, consistent with public proof-of-concept material, while the authoritative assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Practical exploitability is limited mainly by whether the router’s administrative interface is reachable from the attacker’s network segment, since such interfaces are usually bound to the LAN.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated network-reachable overflow (AV:N/AC:L/PR:N/UI:N) per the vector; stack overflow on embedded firmware plausibly yields full code execution, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.
Executive ViewAI
The Tenda WH450 router running firmware 1.0.0.18 contains a high-severity memory-corruption flaw in its web-management HTTP handler that can compromise device confidentiality, integrity, and availability when the management interface is reachable. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis, so leadership should prioritize reducing management-interface exposure for deployed units, especially in branch or home-office environments.
No vendor-released patch identified at time of analysis; restrict web-management access to trusted LAN/VLAN only, disable remote/WAN administration, block /goform/PPTPDClient at network boundaries, segment or replace affected Tenda WH450 1.0.0.18 devices, and monitor for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows an authenticated attacker who can reach the router's
Exploit-DB