CVE-2023-39672
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Version 1.0.0.18 of the Tenda WH450 has a buffer overflow vulnerability in the fgets function.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially leading to device takeover.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability.
Other vulnerabilities in Tenda WH450 v1.0.0.18
See all- CVE-2025-15046Critical
A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-15045Critical
A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler. This manipulation of the argument page causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
- CVE-2025-15044Critical
A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
- CVE-2025-15010Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown processing in the file /goform/SafeUrlFilter. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15007Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown functionality in the file /goform/L7Im of the HTTP Request Handler component. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15180High
Tenda WH450 version 1.0.0.18 has a stack-based buffer overflow vulnerability in the /goform/webExcptypemanFilte function. Manipulation of the page argument can lead to buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2025-15179High
Tenda WH450 version 1.0.0.18 has a stack-based buffer overflow vulnerability in the /goform/qossetting function. Manipulation of the page argument causes buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-15178High
A vulnerability was found in Tenda WH450 1.0.0.18. The HTTP Request Handler component, specifically the file /goform/VirtualSer, is affected. Manipulation of the page argument results in a stack-based buffer overflow. The attack can be launched remotely and the exploit has been made public.
- CVE-2025-15177High
A vulnerability has been found in Tenda WH450 1.0.0.18. The HTTP Request Handler component, specifically the file /goform/SetIpBind, is affected. Manipulation of the page argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been disclosed to the public.
- CVE-2025-15163High
A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

