EUVD-2025-21258CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7530 is a critical stack-based buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14(408) affecting the PPTP client configuration function. An authenticated remote attacker can exploit this vulnerability by supplying a malicious Username argument to the /goform/PPTPDClient endpoint, potentially achieving remote code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the vulnerability meets criteria for active exploitation risk.
Technical Context
This vulnerability exists in the fromPptpUserAdd function within the PPTP (Point-to-Point Tunneling Protocol) client implementation on Tenda FH1202 routers. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The vulnerable code path is accessed through the /goform/PPTPDClient web interface endpoint. PPTP is a legacy tunneling protocol often used for VPN connectivity, and the buffer overflow occurs when the Username parameter is processed without proper bounds checking, allowing an attacker to overwrite stack memory including return addresses and execute arbitrary code. The affected CPE is: cpe:2.7.a:tenda:fh1202_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*
Affected Products
Tenda FH1202 Wireless Router - Firmware version 1.2.0.14(408) specifically confirmed affected. CPE: cpe:2.7.a:tenda:fh1202_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*. The FH1202 is a 300Mbps wireless router commonly distributed in Asian markets. Other firmware versions of FH1202 may also be vulnerable but are not explicitly confirmed in available intelligence. Related Tenda router models with similar PPTP implementations may be similarly affected but require individual analysis.
Remediation
Immediate actions: (1) Tenda should release a patched firmware version addressing the buffer overflow in the fromPptpUserAdd function—check Tenda's official support site for FH1202 firmware updates beyond 1.2.0.14(408); (2) Disable PPTP client functionality if not required, or restrict access to the /goform/PPTPDClient endpoint via firewall rules; (3) Implement network segmentation to limit administrative access to router management interfaces; (4) Change default router credentials and use strong passwords for any administrative accounts; (5) Monitor router logs for suspicious PPTP configuration attempts. Vendors/users should contact Tenda support directly for patch availability status. Until patches are available, disable PPTP functionality entirely if the feature is not actively used.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today