What is the CVSS score of CVE-2025-7506?

CVE-2025-7506 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Fh451 Firmware are affected by CVE-2025-7506?

A critical remote code execution vulnerability affects Tenda FH451 routers with no available patch, creating immediate risk for organizations relying on this device for network connectivity.

Is there a public PoC exploit available for CVE-2025-7506?

Yes, a public proof-of-concept exploit is available for CVE-2025-7506. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-7506?

Within 24 hours: Inventory all Tenda FH451 devices in your environment and isolate affected units from production networks if operationally feasible. Within 7 days: Implement network segmentation to restrict access to affected devices and deploy WAF rules blocking POST requests to /goform/Natlimit with suspicious page parameters. Within 30 days: Develop a replacement strategy—contact Tenda for firmware updates or plan migration to alternative router models with active security support.

Fh451 Firmware CVE-2025-7506

EUVD-2025-21237 HIGH

Buffer Overflow (CWE-119)

2025-07-12 cna@vuldb.com

Buffer Overflow Tenda Fh451 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21237

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 17:49 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7506 is a critical stack-based buffer overflow vulnerability in Tenda FH451 router firmware version 1.0.0.9, exploitable via the HTTP POST parameter 'page' in the /goform/Natlimit endpoint. An authenticated remote attacker can achieve complete system compromise (code execution, data exfiltration, denial of service) without user interaction. Public exploit code is available, indicating active disclosure and likely exploitation in the wild.

Technical ContextAI

The vulnerability exists in the HTTP POST request handler for the /goform/Natlimit component, specifically in the fromNatlimit function. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow where user-supplied input in the 'page' parameter is copied to a fixed-size stack buffer without proper bounds checking. This affects the Tenda FH451 wireless router (CPE: cpe:2.3:o:tenda:fh451_firmware:1.0.0.9:*:*:*:*:*:*:*), a consumer-grade networking device. The HTTP POST interface suggests the vulnerability is in the device's web management interface, likely implemented in C/C++ without memory-safe bounds validation.

RemediationAI

Immediate actions: (1) Identify all Tenda FH451 devices running firmware 1.0.0.9 in your network; (2) Check Tenda's official support page for firmware updates (typically available at support.tenda.com.cn or your regional Tenda support site); (3) If patched firmware is available (versions post-1.0.0.9), upgrade immediately via the device's web interface (Administration > Firmware Upgrade); (4) If no patch exists, implement compensating controls: restrict HTTP/HTTPS management interface access to trusted IP ranges only, disable remote management features if not essential, change default/weak credentials to strong random passwords, and consider isolating affected devices to a separate network segment. (5) Monitor device logs for suspicious POST requests to /goform/Natlimit endpoint. Patch availability status requires checking Tenda's official advisory; organizations should contact Tenda support directly for confirmed patch timelines.