What is the CVSS score of CVE-2025-5978?

CVE-2025-5978 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Fh1202 Firmware are affected by CVE-2025-5978?

A critical remote code execution vulnerability affects Tenda FH1202 routers with no available patch, allowing unauthenticated attackers to compromise network infrastructure.

Is there a public PoC exploit available for CVE-2025-5978?

Yes, a public proof-of-concept exploit is available for CVE-2025-5978. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-5978?

Within 24 hours: Inventory all Tenda FH1202 devices in production and isolate affected units from critical network segments. Within 7 days: Implement network-level mitigations (WAF rules blocking /goform/VirtualSer requests, network segmentation restricting router admin access). Within 30 days: Replace vulnerable devices with patched firmware or alternative vendor solutions, or implement hardware-based network access controls as interim solution.

Fh1202 Firmware CVE-2025-5978

EUVD-2025-17834 HIGH

Buffer Overflow (CWE-119)

2025-06-10 cna@vuldb.com

Buffer Overflow Fh1202 Firmware Tenda RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17834

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 20, 2025 - 14:47 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda FH1202 1.2.0.14. It has been classified as critical. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical stack-based buffer overflow vulnerability exists in Tenda FH1202 firmware version 1.2.0.14 within the /goform/VirtualSer endpoint's fromVirtualSer function, triggered by unsanitized 'page' parameter manipulation. An authenticated attacker can exploit this remotely to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.

Technical ContextAI

The vulnerability is a classic stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the Tenda FH1202 router's web management interface. The affected component is the /goform/VirtualSer endpoint, which processes HTTP requests through the fromVirtualSer function. The 'page' parameter is passed to this function without proper bounds checking or input validation, allowing an attacker to write beyond allocated stack buffer boundaries. This affects Tenda FH1202 specifically at firmware version 1.2.0.14. The router's web service (typically running on port 80/443) processes these requests with elevated privileges, making successful exploitation capable of achieving root-level code execution. The vulnerability likely stems from unsafe C string handling functions (strcpy, sprintf, or similar) without length validation.

RemediationAI

Immediate remediation steps: (1) Check installed firmware version on all Tenda FH1202 devices via Web UI > System Settings > Firmware Version; (2) Contact Tenda support or visit the official Tenda support website to obtain and deploy the latest patched firmware version beyond 1.2.0.14 (specific patch version should be confirmed from Tenda advisory, not provided in CVE description); (3) If patching is delayed, implement network-level mitigations: restrict access to the router's web management interface (port 80/443) to trusted IP addresses only via firewall rules, disable remote management if enabled, enforce strong authentication credentials (change default admin/password), and monitor router logs for suspicious activity. (4) As a temporary measure, isolate affected routers from untrusted network segments. (5) Tenda should publish a security advisory with specific patched firmware versions and deployment timeline. Organizations should establish a firmware update schedule for all network appliances.