Tenda WH450
CVE-2025-15161
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router admin interface
-
DeliverySend crafted /goform/PPTPUserSetting request
-
ExploitOverflow stack via oversized delno argument
-
ExecutionCorrupt stack / hijack control flow
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated administrative access to the device's web management interface, since the vulnerable /goform/PPTPUserSetting handler is a privileged configuration endpoint (reflected in CVSS PR:H). The specific trigger is a manipulated 'delno' argument sent to that endpoint, which overflows a stack buffer (CWE-119). Limiting factors: the attacker must already hold admin credentials or a valid admin session, and the affected scope is firmware version 1.0.0.18 of the Tenda WH450 specifically; it is network-reachable (AV:N) with no user interaction required, so an exposed or shared-credential management interface materially raises risk. |
| Impact | Signals are mixed and point to a real but constrained issue. The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:H/VI:H/VA:H) scores 7.3 with high vulnerable-system impact, but the decisive mitigating factor is PR:H - exploitation requires high (administrative) privileges on the device, meaning an attacker must already be authenticated to the router's management interface. The vector embeds E:P (Proof-of-Concept), consistent with the publicly available exploit on GitHub, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input. So the honest read is 'publicly available exploit code exists' against an admin-authenticated endpoint, not a wormable unauthenticated flaw. This is a moderate-priority issue for exposed/shared-admin Tenda WH450 deployments rather than a mass-exploitation emergency; the high-privilege requirement substantially lowers real-world risk versus the raw 7.3 score. Note the source is VulDB/CNA (cna@vuldb.com), a research-driven report with no first-party Tenda advisory confirmed in the data. |
| Exploit ScenarioDerived | An attacker who has obtained administrative access to the Tenda WH450 web interface (via default/weak credentials, credential reuse, or an exposed management port) sends a crafted request to /goform/PPTPUserSetting with an oversized or malformed 'delno' argument, overflowing a stack buffer. A public proof-of-concept for this exact endpoint is available on GitHub, lowering the effort to reproduce and potentially achieve code execution or device crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in the Tenda WH450 router (firmware version 1.0.0.18) can be triggered by sending a crafted 'delno' argument to the /goform/PPTPUserSetting configuration endpoint, allowing memory corruption that can be leveraged for code execution or denial of service. Exploitation requires authenticated administrative access to the device's web management interface, since the vulnerable handler is a privileged configuration endpoint (CVSS PR:H), though the attack itself is network-reachable with no user interaction. Publicly available exploit code exists in a GitHub proof-of-concept, and no vendor-released patch has been identified at time of analysis; the affected scope is limited to this specific firmware version, so risk concentrates on devices with exposed or default-credentialed management interfaces.
RemediationAI
No vendor-released patch has been identified at time of analysis, so mitigation must rely on compensating controls until Tenda publishes fixed firmware. First, remove the management interface from untrusted networks: restrict access to the web UI on port 80/443 to a trusted administrative VLAN or specific source IPs via firewall ACL - the trade-off is that remote administration and cloud/mobile management conveniences will stop working from outside that range. Second, change all default and shared administrative credentials immediately and audit for any unauthorized admin accounts, because the vulnerability requires an authenticated session (PR:H) and shared or default passwords are the primary path to that prerequisite. Third, disable remote/WAN-side management and UPnP exposure on the router if those features are not strictly required, accepting the loss of remote reachability. Fourth, segment the router so that a compromised admin session cannot pivot to adjacent network assets. Monitor Tenda's advisory page (https://www.tenda.com.cn/) and the VulDB entry (https://vuldb.com/?id.338536) for a firmware update, and replace or retire the WH450 if it is end-of-support. Given the publicly available exploit code, treat any device still running 1.0.0.18 with an internet-exposed management interface as high priority for these controls.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 memory-bounds violation: the /goform/PPTPUserSetting handler in the Tenda WH450 web management stack copies the user-supplied 'delno' parameter into a fixed-size buffer on the stack without validating its length, so an oversized value overwrites adjacent stack memory, including saved registers and the return address, giving an attacker control over the execution path. The CPE record confirms the affected platform is Tenda WH450 firmware 1.0.0.18 (cpe:2.3:o:tenda:wh450_firmware:1.0.0.18), an embedded GoAhead-style HTTP form handler reachable over the network; the PPTP user settings functionality is the specific feature surface. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and the provided CVSS 4.0 vector both place the privilege prerequisite at PR:H, meaning the request must come from a session already holding administrative rights on the device, which constrains the vulnerability to post-authentication or credential-compromise scenarios rather than unauthenticated remote takeover. Exploitation is deterministic and low-complexity once a valid admin session exists.
Know when Wh450 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin endpoint (AV:N/AC:L) but requires administrative authentication to reach /goform/PPTPUserSetting, so PR:H; buffer overflow enables full code execution impact (C/I/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argument delno results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Executive ViewAI
Tenda WH450 routers running firmware 1.0.0.18 - a small-office/edge device that may sit on our network perimeter or in branch and remote locations - contain a memory-corruption flaw in their web management interface that can be turned into remote code execution or a denial-of-service condition. Publicly available exploit code exists, no vendor-released patch has been identified at time of analysis, and the vulnerable endpoint requires administrative credentials, so leadership exposure is concentrated in devices whose management interfaces are internet-reachable or still using default passwords. Organizations fielding these units should treat any such router as a potentially compromised network entry point until it is isolated, hardened, or replaced.
No vendor-released patch identified at time of analysis; interim mitigations are to remove WAN exposure of the management interface, restrict administrative access to a VPN or strict source-IP allowlist, enforce strong non-default administrative credentials, segment affected routers away from sensitive network segments, monitor and alert on requests to /goform/PPTPUserSetting, and replace or isolate units that cannot be secured.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Wh450 Firmware
View allA stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to co
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to cor
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory o
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory and potentially a
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corr
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory,
Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote atta
Stack-based buffer overflow in the HTTP management interface of the Tenda WH450 router (firmware 1.0.0.18) allows an att
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows remote attackers with administrative credentials (PR
Authenticated stack-based buffer overflow in the HTTP management service of Tenda WH450 firmware 1.0.0.18 lets a remote
An authenticated stack-based buffer overflow in the Tenda WH450 router (firmware 1.0.0.18) lets a high-privileged user c
Exploit-DB