PT-2025-52852 · Tenda · Tenda Wh450

Z472421519 · CVE-2025-15047 · Published 2025-12-23 · Updated 2025-12-24

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda WH450 version 1.0.0.18

Description A stack-based buffer overflow exists in the HTTP Request Handler component of the Tenda WH450. The issue is triggered by manipulating the Username argument in the '/goform/PPTPDClient' file. The attack can be initiated remotely. The exploit has been made public and could be used to hijack devices. Elevated activities targeting this vulnerability have been observed.

Recommendations For Tenda WH450 version 1.0.0.18, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-15047

Affected Products

Tenda Wh450

References · 14

• 🔥 https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md#reproduce · Exploit
• 🔥 https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-15047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15047 · Security Note
• https://twitter.com/CVEnew/status/2003700508520047050 · Twitter Post
• https://vuldb.com/?id.337852 · Note
• https://vuldb.com/?ctiid.337852 · Note
• https://twitter.com/0dayPublishing/status/2003589084837507391 · Twitter Post
• https://vuldb.com/?submit.720884 · Note
• https://twitter.com/CveFindCom/status/2003596226692866273 · Twitter Post
• https://twitter.com/vuldb/status/2003771269540725005 · Twitter Post
• https://twitter.com/vuldb/status/2003599040991363557 · Twitter Post
• https://tenda.com.cn · Note
• https://t.me/CVEtracker/40532 · Telegram Post