CVE-2025-15046
📋 TL;DR
This is a critical stack-based buffer overflow vulnerability in Tenda WH450 routers that allows remote attackers to execute arbitrary code by sending specially crafted HTTP requests. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running Tenda WH450 firmware version 1.0.0.18 are affected.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Remote code execution resulting in device takeover, credential theft, network traffic interception, and denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit code is available on GitHub. The vulnerability requires sending a specially crafted HTTP POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for WH450. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Block HTTP access to router management
allConfigure firewall rules to block external HTTP access to router management interface (typically port 80).
Disable PPTP client functionality
allIf PPTP client feature is not needed, disable it in router settings to remove the vulnerable endpoint.
🧯 If You Can't Patch
- Segment affected routers into isolated network zones with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to /goform/PPTPClient endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.0.0.18, the device is vulnerable.Check Version:
Log into router web interface and check System Status or Firmware Version pageVerify Fix Applied:
After updating firmware, verify the version is no longer 1.0.0.18 and test that the /goform/PPTPClient endpoint responds appropriately to malformed requests.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/PPTPClient with unusually long netmsk parameter
- Router crash/reboot logs
- Unusual process execution
Network Indicators:
- HTTP traffic to router IP on port 80 with POST to /goform/PPTPClient
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/PPTPClient" AND method="POST" AND param_length>100)🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md#reproduce
- https://vuldb.com/?ctiid.337851
- https://vuldb.com/?id.337851
- https://vuldb.com/?submit.720883
- https://www.tenda.com.cn/
