Tenda FH1201
CVE-2025-14994
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface with low-priv credentials
-
DeliverySend crafted HTTP request to /goform/webtypelibrary
-
ExploitOverflow stack buffer via oversized webSiteId in strcat
-
ExecutionHijack control flow / corrupt stack
-
ImpactExecute code or crash device on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to send a crafted HTTP request to the /goform/webtypelibrary endpoint of the Tenda FH1201 or FH1206 web management interface, supplying an overlong webSiteId argument that overflows a stack buffer in a strcat call. The CVSS 4.0 vector specifies PR:L, meaning low-privilege authentication to the management interface is required (not independently confirmed by the description). No user interaction is needed (UI:N). Limiting factors: exploitation depends on network reachability to the HTTP management interface - on default deployments this is LAN-side rather than WAN-side - and on the authentication prerequisite; affected to specific firmware builds (FH1201 1.2.0.14(408), FH1206 1.2.0.8(8155)). |
| Impact | This is a stack-based buffer overflow in the HTTP request handler of Tenda FH1201 and FH1206 SOHO routers, triggered via the webSiteId parameter in /goform/webtypelibrary (CWE-119). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L = authenticated) with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (github-poc references), but the EPSS score is only 0.75% (54th percentile), reflecting low modeled probability of broad exploitation in the next 30 days, and the vulnerability is NOT in CISA KEV - so there is no confirmed active exploitation. The SSVC exploitation status maps to 'publicly available exploit code exists' (E:P in the vector). Overall this is a moderate, not top-tier, priority: genuine code-execution/DoS risk on exposed devices with a working PoC, but mitigated by the authentication requirement and typically LAN-facing management interfaces. It becomes high priority only where the router web UI is internet-exposed or uses default/weak credentials. Note the apparent tension: the CVSS vector says PR:L (authenticated) while the terse description only says the attack 'is possible to be carried out remotely' and does not mention authentication - verify the auth prerequisite against the vendor and PoC. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface and low-level credentials sends a crafted HTTP request to /goform/webtypelibrary containing an oversized webSiteId value, overflowing a stack buffer in the strcat operation. Public proof-of-concept exploit code is available, enabling reliable triggering to crash the device (DoS) or potentially execute arbitrary code on the router. The attack requires network reachability to the management interface, which on default SOHO deployments is LAN-side. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote stack-based buffer overflow in the Tenda FH1201 and FH1206 SOHO router firmware (FH1201 1.2.0.14(408) and FH1206 1.2.0.8(8155)) allows an attacker who can reach the web management interface to corrupt the stack by sending a crafted HTTP request to /goform/webtypelibrary with an overlong webSiteId argument, writing past the bounds of a fixed-size stack buffer inside a strcat call. Successful corruption gives high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 7.4, assessed CVSS 3.1 8.8), and the CVSS 4.0 vector specifies PR:L - authenticated (low-privilege) access to the management interface - with no user interaction required; exploitation additionally depends on network reachability to the HTTP management interface, which on default deployments is LAN-side rather than WAN-side. Publicly available exploit code exists (two GitHub write-ups covering both FH1201 and FH1206), and EPSS is low at 0.75% (54th percentile); there is no confirmed actively exploited (CISA KEV) status at time of analysis.
RemediationAI
No vendor-released patch is identified in the available data - the references point only to VulDB submissions and the Tenda homepage (https://www.tenda.com.cn/), with no firmware fix version published for either model - so operators should first check Tenda's support site for a newer FH1201/FH1206 firmware build and apply it if one supersedes 1.2.0.14(408) or 1.2.0.8(8155). Until a fix exists, the most effective compensating control is to remove reachability to the web management interface: disable WAN/remote administration, keep the admin UI bound to the LAN only, and restrict it with a firewall rule or ACL that permits only specific trusted management hosts, accepting the trade-off that administration then requires a jump host or local connection. Changing the default administrator password and eliminating any shared or guest access to the management VLAN reduces the PR:L authentication prerequisite, but does not remove the overflow for an authenticated attacker, so it should be combined with network restriction rather than relied on alone. Because exploitation is triggered by an oversized webSiteId in a POST to /goform/webtypelibrary, logging and alerting on unusually long parameter values or repeated requests to that endpoint provides a detection opportunity, though it is a detective rather than preventive measure and can be evaded. Given that public exploit code is already available for both models and consumer firmware in this class is rarely maintained long-term, replacing the device with a supported router or putting it behind a strict LAN-only management segment is the most durable mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-119, memory buffer bounds) in the HTTP request handler of the Tenda FH1201 and FH1206 firmware images, specifically in the function that performs a strcat into a fixed-size stack buffer while processing the webSiteId argument of the /goform/webtypelibrary goform endpoint. Because strcat appends without any length check, an attacker-supplied webSiteId longer than the destination buffer overwrites adjacent stack memory, including saved registers and the return address, which on typical embedded SOHO router builds (often without stack canaries or with limited ASLR) can be leveraged toward control-flow hijack and code execution in the context of the device's HTTP daemon (frequently running as root). Affected CPE identifiers are cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14\(408\) and cpe:2.3:o:tenda:fh1206_firmware:1.2.0.8\(8155\), confirming the issue is in firmware rather than a standalone application. The attack surface is the embedded web configuration server shipped with these routers, and the weakness class maps to the well-known family of unauthenticated or weakly authenticated management-interface overflow bugs in consumer networking gear; the public PoC write-ups under the BinaryAudit repository describe the reverse-engineering path from endpoint to the vulnerable strcat sink for both models.
Know when Fh1201 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable HTTP endpoint (AV:N) with reliable PoC (AC:L); PR:L reflects the authenticated management interface per the input vector; memory corruption yields potential code execution, so C/I/A:H.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the component HTTP Request Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Executive ViewAI
Tenda FH1201 and FH1206 SOHO routers, often deployed in branch offices and remote work environments, are affected by a high-severity stack buffer overflow that allows authenticated attackers with local network access to fully compromise the device. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis. Leadership should prioritize mitigation because these routers may serve as gateways to corporate networks, and a compromise could lead to broader security incidents.
No vendor patch available. Interim mitigations: restrict management interface to trusted LAN only, enforce strong authentication, change default credentials, monitor for exploitation attempts, and segment affected devices. Consider replacing devices if vendor does not provide a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Fh1201 Firmware
View allAn issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary
Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/Wr
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword param
CVE-2025-7551 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) aff
CVE-2025-7550 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) aff
CVE-2025-7549 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) aff
CVE-2025-7548 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 wireless router firmware version 1
Critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) affecting the /goform/
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
CVE-2025-7465 is a critical remote buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14 affecting the
Exploit-DB