Critical · published December 14, 2025
🔥 A stack-based buffer overflow vulnerability in Tenda WH450 could let attackers take full control remotely—no physical access needed! Think of this flaw like a crowded elevator that suddenly goes haywire; just a small push in the wrong spot can send everything tumbling down, risking complete chaos. Here, a sneaky manipulation of the DHCP list can overflow the stack and leave everything wide open. This is absolutely devastating! An attacker could exploit this vulnerability to execute malicious code on your device, potentially allowing them to access sensitive information, hijack your network, or even launch further attacks. The fallout could be catastrophic, affecting not just your Tenda device but anything connected to it.
Think of this flaw like a crowded elevator that suddenly goes haywire; just a small push in the wrong spot can send everything tumbling down, risking complete chaos. Here, a sneaky manipulation of the DHCP list can overflow the stack and leave everything wide open. This vulnerability lies within the HTTP Request Handler of the Tenda WH450. By manipulating the 'page' argument in the /goform/DhcpListClient, an attacker can trigger a stack-based buffer overflow, leading to unauthorized code execution.
This is absolutely devastating! An attacker could exploit this vulnerability to execute malicious code on your device, potentially allowing them to access sensitive information, hijack your network, or even launch further attacks. The fallout could be catastrophic, affecting not just your Tenda device but anything connected to it. To secure your Tenda WH450, update to version 1.0.0.19 immediately and disable any remote access features if they're not needed. Regularly audit your device settings to ensure no unauthorized changes have been made. You've got this! Follow these steps, and you'll bolster your defenses in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tenda/wh450_firmware | all versions | — |