EUVD-2025-18367Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) affecting the /goform/SafeMacFilter endpoint. An authenticated remote attacker can exploit the 'page' parameter to achieve remote code execution with high confidentiality, integrity, and availability impact. Public exploit code exists and the vulnerability is actively exploitable.
Technical ContextAI
The vulnerability exists in the SafeMacFilter form handler within Tenda's proprietary firmware, likely implemented in C/C++ without proper input validation. The stack-based buffer overflow (CWE-119) occurs when the 'page' parameter is passed without bounds checking to a fixed-size stack buffer, allowing attackers to overwrite the stack frame and potentially execute arbitrary code. Tenda FH1201 is a wireless router/access point that uses embedded Linux with custom web interface handlers. The /goform endpoint is a CGI application handler typical in consumer networking equipment that processes form submissions. CPE identifier: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*
RemediationAI
Immediate actions: (1) Update FH1201 firmware to version newer than 1.2.0.14(408) if available from Tenda's support portal or device web interface (Administration > Firmware Upgrade). (2) Disable remote management/WAN access to the router's web interface if not required (Administration > Remote Management—disable). (3) Change default administrative credentials (typically admin/admin on Tenda devices). (4) Restrict access to /goform endpoints via firewall rules at network perimeter. (5) Monitor for suspicious POST requests to /goform/SafeMacFilter in device logs. Contact Tenda support (support.tenda.com.cn or regional support) for patched firmware availability and timeline. Workaround: isolate affected device to trusted LAN only until patch is deployed.
Share
External POC / Exploit Code
Leaving vuln.today