CVE-2025-15161
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote attackers to execute arbitrary code by manipulating the 'delno' parameter in the /goform/PPTPUserSetting endpoint. This affects Tenda WH450 routers running firmware version 1.0.0.18. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda WH450
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, credential theft, lateral movement into internal networks, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Denial of service or limited information disclosure if exploit fails to achieve code execution.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Remote exploitation requires no authentication. Simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for WH450
3. Log into router admin interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and apply new firmware
6. Reboot router after update
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Login to router admin > System Tools > Remote Management > Disable
Network Segmentation
linuxIsolate router management interface to trusted network
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_NET -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_NET -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected Tenda WH450 routers with different models or brands
- Implement strict network access controls to limit exposure of router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/ | grep -i 'firmware' or check web interfaceVerify Fix Applied:
Verify firmware version is no longer 1.0.0.18 and test if /goform/PPTPUserSetting endpoint still accepts malformed delno parameter📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/PPTPUserSetting with unusually long delno parameter
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 containing 'delno=' with long strings
- Sudden changes in router configuration
SIEM Query:
source="router_logs" AND (uri="/goform/PPTPUserSetting" AND (param="delno" AND length>100))