CVE-2025-15047
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda WH450 routers by sending specially crafted HTTP requests to the PPTPDClient endpoint. Attackers can exploit a stack-based buffer overflow in the Username parameter to gain full control of affected devices. All users running vulnerable firmware versions are at risk.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Public proof-of-concept demonstrates reliable exploitation. No authentication required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for WH450
3. Log into router admin interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Reboot router after update completes
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable routers from critical network segments
Access Control Lists
linuxBlock external access to router web interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace vulnerable devices with supported models
- Implement strict network monitoring for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 1.0.0.18📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/PPTPDClient
- Large Username parameter values in web logs
- Router reboot events
Network Indicators:
- HTTP requests with oversized Username parameters
- Traffic to router on port 80 from unexpected sources
SIEM Query:
source="router-logs" AND uri="/goform/PPTPDClient" AND username.length>100🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md#reproduce
- https://vuldb.com/?ctiid.337852
- https://vuldb.com/?id.337852
- https://vuldb.com/?submit.720884
- https://www.tenda.com.cn/
