Stack-Based Buffer Overflow in Tenda WH450 HTTP Handler

Publication date: 2025-12-23

Last updated on: 2025-12-23

Assigner: VulDB

Description

A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-23

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-15046

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	wh450	1.0.0.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Tenda WH450 device, specifically in an unknown function within the /goform/PPTPClient file of the HTTP Request Handler component. It involves manipulation of the 'netmsk' argument, which leads to a stack-based buffer overflow. This type of vulnerability allows an attacker to overwrite parts of the memory stack, potentially enabling remote code execution or causing the device to crash. The attack can be launched remotely without authentication.

Impact Analysis

The vulnerability can have severe impacts including remote code execution, denial of service, or complete compromise of the affected device. Since it is a stack-based buffer overflow exploitable remotely without authentication, attackers can gain control over the device, disrupt its normal operation, or use it as a foothold to attack other systems on the network.

Hi! I’m here to help you understand CVE-2025-15046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70