CVE-2023-39672
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Version 1.0.0.18 of the Tenda WH450 has a buffer overflow vulnerability in the fgets function.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially leading to device takeover.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability.
Other vulnerabilities in Tenda WH450 v1.0.0.18
See all- CVE-2025-15046Critical
A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-15045Critical
A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler. This manipulation of the argument page causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
- CVE-2025-15044Critical
A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
- CVE-2025-15010Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown processing in the file /goform/SafeUrlFilter. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15007Critical
A vulnerability in Tenda WH450 1.0.0.18 affects unknown functionality in the file /goform/L7Im of the HTTP Request Handler component. Manipulation of the argument page leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets.