CVE-2025-15047
Published: 23 December 2025
Summary
CVE-2025-15047 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Wh450 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing the stack-based buffer overflow in the Tenda WH450 firmware by applying patches or updates.
SI-10 enforces information input validation on the Username argument in the /goform/PPTPDClient HTTP handler to prevent buffer overflows.
SI-16 implements memory protections such as stack canaries and non-executable stacks to mitigate remote exploitation of the stack-based buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the unauthenticated HTTP handler (/goform/PPTPDClient) of the public-facing Tenda WH450 router web interface enables remote exploitation for arbitrary code execution (T1190: Exploit Public-Facing Application) or denial of service via application crash (T1499.004: Application or System Exploitation).
NVD Description
A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated…
more
remotely. The exploit has been made public and could be used.
Deeper analysisAI
CVE-2025-15047 is a stack-based buffer overflow vulnerability affecting Tenda WH450 router firmware version 1.0.0.18. The flaw exists in an unknown function of the /goform/PPTPDClient file within the HTTP Request Handler component, triggered by manipulation of the Username argument. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation without authentication, privileges, or user interaction, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can initiate the exploit over the network, potentially achieving full control over the affected device through arbitrary code execution, compromising confidentiality, integrity, and availability.
References point to a publicly available Proof-of-Concept (PoC) on GitHub, including reproduction steps for the buffer overflow in Tenda WH450's PPTPDClient. VulDB entries provide further details on the issue, though no specific patches or vendor advisories are detailed in the available information. The exploit has been made public and could be used.
Details
- CWE(s)