A critical stack-based buffer overflow vulnerability in Tenda WH450 firmware version 1.0.0.18 poses a significant risk of arbitrary code execution.

The vulnerability is a stack-based buffer overflow located in the /goform/PPTPServer endpoint, which is triggered when processing the ip1 parameter. Although the CVSS vector indicates a requirement for high privileges, technical documentation confirms that an attacker can reach this function through authenticated sessions to execute arbitrary code or cause a crash.

Successful exploitation of this buffer overflow allows an attacker to gain unauthorized control over the affected router. This could lead to full device compromise, network traffic interception, or permanent denial of service. With a CVSS score of 7.2, the vulnerability represents a high risk to organizational infrastructure, particularly if these devices are used to manage secure segments of the network.

Immediate Action: Since no official vendor patch is currently available, administrators should immediately restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests directed at the /goform/PPTPServer endpoint, particularly those containing long strings in the ip1 parameter field.

Compensating Controls: Implement a Web Application Firewall or an Intrusion Prevention System to detect and drop requests that contain malformed parameters or excessive data lengths sent to the device management interface.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the provided research write-up on GitHub.

Given the availability of a public proof-of-concept and the nature of the vulnerability, organizations should prioritize isolating affected Tenda WH450 devices from the internet. Until a security update is released by Tenda, disabling the PPTP server functionality or limiting access to the management interface is the most effective way to mitigate the risk of arbitrary code execution.