PT-2025-52850 · Tenda · Tenda Wh450

Z472421519 · Published 2025-12-23 · Updated 2025-12-24 · CVE-2025-15046

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda WH450 version 1.0.0.18

Description A stack-based buffer overflow exists in the HTTP Request Handler component of the Tenda WH450. The issue is located in the /goform/PPTPClient file and can be triggered by manipulating the netmsk argument. This allows for remote exploitation of the device. The exploit has been publicly disclosed. The vulnerable function is unknown.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-15046

Affected Products

Tenda Wh450

References · 14

• 🔥 https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md · Exploit
• 🔥 https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md#reproduce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15046 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15046 · Vendor Advisory
• https://t.me/CVEtracker/40531 · Telegram Post
• https://twitter.com/transilienceai/status/2003669989057048800 · Twitter Post
• https://twitter.com/CveFindCom/status/2003596254182363600 · Twitter Post
• https://twitter.com/CVEnew/status/2003700532293304392 · Twitter Post
• https://vuldb.com/?ctiid.337851 · Note
• https://vuldb.com/?submit.720883 · Note
• https://twitter.com/VulmonFeeds/status/2003667282204012904 · Twitter Post
• https://tenda.com.cn · Note
• https://twitter.com/0dayPublishing/status/2003581534251491771 · Twitter Post
• https://vuldb.com/?id.337851 · Note