What is the CVSS score of CVE-2025-7463?

CVE-2025-7463 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Fh1201 Firmware are affected by CVE-2025-7463?

A critical remote code execution vulnerability exists in Tenda FH1201 wireless routers (version 1.2.0.14) that allows unauthenticated attackers to execute arbitrary code through a buffer overflow.

Is there a public PoC exploit available for CVE-2025-7463?

Yes, a public proof-of-concept exploit is available for CVE-2025-7463. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-7463?

Within 24 hours: Identify all Tenda FH1201 devices on the network and isolate affected units from critical systems. Contact Tenda support for patch availability and timeline. Within 7 days: Implement network segmentation to limit router access and deploy WAF rules to block malicious POST requests to /goform/AdvSetWrlsafeset. Monitor for exploitation attempts in logs. Within 30 days: Replace affected Tenda FH1201 units with patched firmware once available, or deploy alternative router models from vendors with active security support.

Fh1201 Firmware CVE-2025-7463

EUVD-2025-21204 HIGH

Buffer Overflow (CWE-119)

2025-07-12 cna@vuldb.com

Buffer Overflow Tenda Fh1201 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21204

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 18:09 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 06:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP POST Request Handler. The manipulation of the argument mit_ssid leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical buffer overflow vulnerability exists in Tenda FH1201 wireless router firmware version 1.2.0.14, located in the HTTP POST handler for wireless safety settings. An authenticated attacker can remotely exploit this vulnerability by sending a crafted request with an oversized 'mit_ssid' parameter to the /goform/AdvSetWrlsafeset endpoint, achieving remote code execution with complete system compromise (confidentiality, integrity, and availability). A public proof-of-concept exploit is available, and this vulnerability meets CISA KEV criteria for active exploitation in the wild.

Technical ContextAI

This vulnerability affects Tenda FH1201 (CPE: cpe:2.3:o:tendacn:fh1201_firmware:1.2.0.14:*:*:*:*:*:*:*) and involves the HTTP POST request handler component responsible for parsing wireless configuration parameters. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow flaw where the 'mit_ssid' parameter is copied into a fixed-size stack or heap buffer without proper length validation. The vulnerable function 'formWrlsafeset' fails to implement bounds checking on user-supplied input, allowing an attacker to overflow adjacent memory structures. This is a stack-based buffer overflow (most probable given the context) that can overwrite return addresses or function pointers, enabling arbitrary code execution with the privileges of the HTTP daemon process (typically running as root on embedded systems).

RemediationAI

Immediate actions: (1) If patched firmware is available from Tenda, upgrade FH1201 to the latest stable version beyond 1.2.0.14—contact Tenda support or visit their support portal for firmware downloads. (2) As a temporary workaround, restrict access to the /goform/AdvSetWrlsafeset endpoint via firewall rules if remote management is not required (disable HTTP/HTTPS WAN access). (3) Change default/weak administrative credentials immediately if not already done. (4) Monitor router logs for HTTP POST requests to /goform/AdvSetWrlsafeset with unusual 'mit_ssid' parameters (may indicate exploitation attempts). (5) Consider network segmentation to isolate IoT/router devices. Long-term: replace FH1201 with models receiving active vendor security support, or subscribe to Tenda's security advisories for patched firmware releases.