What is the CVSS score of EUVD-2025-18367?

EUVD-2025-18367 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fh1201 Firmware are affected by EUVD-2025-18367?

A critical remote code execution vulnerability affects Tenda FH1201 wireless routers (version 1.2.0.14(408), allowing unauthenticated attackers to compromise network infrastructure without user…

Is there a public PoC exploit available for EUVD-2025-18367?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18367. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2025-18367?

Within 24 hours: Identify and inventory all Tenda FH1201 1.2.0.14(408) devices in your network and segment them from critical systems. Within 7 days: Implement network-level protections (WAF rules blocking requests to /goform/SafeMacFilter with suspicious 'page' parameters, or restrict access via firewall rules to authorized IPs only). Within 30 days: Replace affected devices with alternative vendors or contact Tenda for emergency firmware availability; if replacement is delayed, consider disabling remote management and MAC filtering features entirely.

Fh1201 Firmware EUVD-2025-18367

| CVE-2025-6110 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

Buffer Overflow Tenda Fh1201 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18367

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Jun 17, 2025 - 19:38 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 07:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) affecting the /goform/SafeMacFilter endpoint. An authenticated remote attacker can exploit the 'page' parameter to achieve remote code execution with high confidentiality, integrity, and availability impact. Public exploit code exists and the vulnerability is actively exploitable.

Technical ContextAI

The vulnerability exists in the SafeMacFilter form handler within Tenda's proprietary firmware, likely implemented in C/C++ without proper input validation. The stack-based buffer overflow (CWE-119) occurs when the 'page' parameter is passed without bounds checking to a fixed-size stack buffer, allowing attackers to overwrite the stack frame and potentially execute arbitrary code. Tenda FH1201 is a wireless router/access point that uses embedded Linux with custom web interface handlers. The /goform endpoint is a CGI application handler typical in consumer networking equipment that processes form submissions. CPE identifier: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*

RemediationAI

Immediate actions: (1) Update FH1201 firmware to version newer than 1.2.0.14(408) if available from Tenda's support portal or device web interface (Administration > Firmware Upgrade). (2) Disable remote management/WAN access to the router's web interface if not required (Administration > Remote Management—disable). (3) Change default administrative credentials (typically admin/admin on Tenda devices). (4) Restrict access to /goform endpoints via firewall rules at network perimeter. (5) Monitor for suspicious POST requests to /goform/SafeMacFilter in device logs. Contact Tenda support (support.tenda.com.cn or regional support) for patched firmware availability and timeline. Workaround: isolate affected device to trusted LAN only until patch is deployed.