Tenda WH450 CVE-2025-15160

Exploitation requires the attacker to first have administrative/authenticated access to the router's web management interface (CVSS PR:H), then reach the PPTP server configuration endpoint /goform/PPTPServer and supply an overlong value in the ip1 parameter to trigger the stack-based buffer overflow. Limiting factors: the PR:H prerequisite means this is not exploitable by an unauthenticated attacker, so realistic risk is confined to environments where the admin panel is exposed to untrusted networks, where default/weak admin credentials are in use, or where an attacker has otherwise compromised a management session. No end-user interaction is required (UI:N), and no non-default feature toggle is indicated beyond normal access to the PPTP server configuration page.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, score 7.3) describes a network-reachable but privilege-gated flaw: PR:H means an attacker must already hold high (administrative) privileges on the device before reaching the vulnerable /goform/PPTPServer handler. This significantly tempers real-world risk - it is not a pre-auth remote takeover. Exploit maturity is E:P (proof-of-concept), consistent with the publicly available PoC on GitHub, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The signals are internally consistent (network vector + required authentication + public PoC), with no contradictions to flag. Net assessment: a genuine but moderate-priority issue - a post-authentication stack buffer overflow in an end-of-interest SOHO router. Its practical danger rises mainly where the admin interface is exposed to untrusted networks or where default/weak admin credentials let an attacker satisfy the PR:H prerequisite. Absent EPSS and KEV data, confidence that this is a mass-exploitation target is low; treat it as targeted/opportunistic rather than wormable.

An attacker who has obtained administrative access to the Tenda WH450 web interface (e.g., via default credentials or credential reuse on an exposed management port) sends a crafted request to /goform/PPTPServer with an overlong ip1 argument, overflowing a stack buffer. A public proof-of-concept is already available on GitHub, lowering the effort to reproduce the crash or attempt code execution, which could disrupt the router or lead to arbitrary code execution on the device.