What is the CVSS score of CVE-2025-7529?

CVE-2025-7529 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fh1202 Firmware are affected by CVE-2025-7529?

A high-severity remote code execution vulnerability in Tenda FH1202 routers affects organizations using this network equipment.

Is there a public PoC exploit available for CVE-2025-7529?

Yes, a public proof-of-concept exploit is available for CVE-2025-7529. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7529?

Within 24 hours: Identify all Tenda FH1202 devices in your environment and isolate affected units from critical network segments. Within 7 days: Implement network-level controls (WAF rules, access restrictions) to block exploitation attempts and disable the vulnerable Natlimit function if operationally feasible. Within 30 days: Replace affected devices with patched alternatives or verified secure models, or conduct a formal risk assessment if replacement is not immediately possible.

Fh1202 Firmware CVE-2025-7529

EUVD-2025-21256 HIGH

Buffer Overflow (CWE-119)

2025-07-13 cna@vuldb.com

Buffer Overflow Fh1202 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21256

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:56 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 12:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7529 is a critical stack-based buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14(408) that allows authenticated remote attackers to achieve complete system compromise through manipulation of the 'page' parameter in the /goform/Natlimit endpoint. With a CVSS score of 8.8, public exploit disclosure, and confirmation of active exploitation potential, this vulnerability poses significant real-world risk to deployed Tenda router installations.

Technical ContextAI

The vulnerability exists in the fromNatlimit function within the Tenda FH1202 router's web management interface. This is a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) caused by insufficient input validation on the 'page' parameter. The affected endpoint /goform/Natlimit processes NAT (Network Address Translation) limit configuration requests. Tenda routers are embedded Linux-based devices running proprietary firmware; the vulnerability likely stems from unsafe C string handling (strcpy, sprintf, or similar) in the CGI handler without proper bounds checking. CPE: cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14\(408\):*:*:*:*:*:*:* (firmware) and cpe:2.3:h:tenda:fh1202:*:*:*:*:*:*:*:* (hardware). The stack overflow allows arbitrary code execution in the context of the web service process, typically running with elevated privileges on embedded devices.

RemediationAI

{'type': 'Patch', 'action': 'Contact Tenda support or check https://www.tenda.com.cn/ for firmware updates beyond 1.2.0.14(408). Apply latest stable firmware release for FH1202.', 'priority': 'CRITICAL - Apply immediately'} {'type': 'Workaround', 'action': "Restrict access to the router's web management interface (typically port 80/443) at the network boundary. Disable WAN-side access to the web interface if possible (check router settings under 'Remote Management' or equivalent). Use a VPN or bastion host for legitimate administrative access.", 'priority': 'IMMEDIATE - Deploy if patching is delayed'} {'type': 'Mitigation', 'action': 'Change default router credentials immediately. Implement network segmentation to limit access to administrative interfaces. Monitor for suspicious requests to /goform/Natlimit endpoint in access logs.', 'priority': 'HIGH - Implement in parallel with other controls'} {'type': 'Detection', 'action': "Monitor HTTP POST requests to /goform/Natlimit with unusually long 'page' parameter values (>512 bytes). Log and alert on such requests. Review router access logs for unauthorized administrative access.", 'priority': 'MEDIUM - Deploy logging rules'}