EUVD-2025-17834
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in Tenda FH1202 1.2.0.14. It has been classified as critical. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical stack-based buffer overflow vulnerability exists in Tenda FH1202 firmware version 1.2.0.14 within the /goform/VirtualSer endpoint's fromVirtualSer function, triggered by unsanitized 'page' parameter manipulation. An authenticated attacker can exploit this remotely to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.
Technical Context
The vulnerability is a classic stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the Tenda FH1202 router's web management interface. The affected component is the /goform/VirtualSer endpoint, which processes HTTP requests through the fromVirtualSer function. The 'page' parameter is passed to this function without proper bounds checking or input validation, allowing an attacker to write beyond allocated stack buffer boundaries. This affects Tenda FH1202 specifically at firmware version 1.2.0.14. The router's web service (typically running on port 80/443) processes these requests with elevated privileges, making successful exploitation capable of achieving root-level code execution. The vulnerability likely stems from unsafe C string handling functions (strcpy, sprintf, or similar) without length validation.
Affected Products
Tenda FH1202 firmware version 1.2.0.14 is explicitly confirmed as vulnerable. The specific affected endpoint is /goform/VirtualSer. The vulnerability may also affect other firmware versions of the FH1202 and potentially related Tenda router models (FH1200, FH1206, etc.) if they share similar code paths, though only 1.2.0.14 is confirmed. Affected product CPE approximation: cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14:*:*:*:*:*:*:*. Device CPE: cpe:2.3:h:tenda:fh1202:*:*:*:*:*:*:*:*. Users should verify their firmware version via the router's administrative interface (typically accessible at 192.168.0.1 or similar local gateway address).
Remediation
Immediate remediation steps: (1) Check installed firmware version on all Tenda FH1202 devices via Web UI > System Settings > Firmware Version; (2) Contact Tenda support or visit the official Tenda support website to obtain and deploy the latest patched firmware version beyond 1.2.0.14 (specific patch version should be confirmed from Tenda advisory, not provided in CVE description); (3) If patching is delayed, implement network-level mitigations: restrict access to the router's web management interface (port 80/443) to trusted IP addresses only via firewall rules, disable remote management if enabled, enforce strong authentication credentials (change default admin/password), and monitor router logs for suspicious activity. (4) As a temporary measure, isolate affected routers from untrusted network segments. (5) Tenda should publish a security advisory with specific patched firmware versions and deployment timeline. Organizations should establish a firmware update schedule for all network appliances.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today