EUVD-2025-21208
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7465 is a critical remote buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14 affecting the HTTP POST request handler's fromRouteStatic function. An authenticated attacker can exploit improper input validation on the 'page' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). A public proof-of-concept exploit exists and the vulnerability may be actively exploited in the wild.
Technical Context
The vulnerability exists in the /goform/fromRouteStatic endpoint of Tenda FH1201 wireless router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), which occurs when the HTTP POST handler fails to properly validate or bound-check the 'page' parameter before copying it into a fixed-size buffer. This classic stack or heap buffer overflow in a network-facing HTTP handler allows memory corruption and arbitrary code execution. The affected product is a consumer-grade WiFi router (CPE: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14). The vulnerability is in the embedded HTTP server component that processes router configuration requests, making it directly exploitable via network access.
Affected Products
FH1201 (['1.2.0.14'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today