EUVD-2025-21208Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7465 is a critical remote buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14 affecting the HTTP POST request handler's fromRouteStatic function. An authenticated attacker can exploit improper input validation on the 'page' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). A public proof-of-concept exploit exists and the vulnerability may be actively exploited in the wild.
Technical ContextAI
The vulnerability exists in the /goform/fromRouteStatic endpoint of Tenda FH1201 wireless router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), which occurs when the HTTP POST handler fails to properly validate or bound-check the 'page' parameter before copying it into a fixed-size buffer. This classic stack or heap buffer overflow in a network-facing HTTP handler allows memory corruption and arbitrary code execution. The affected product is a consumer-grade WiFi router (CPE: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14). The vulnerability is in the embedded HTTP server component that processes router configuration requests, making it directly exploitable via network access.
Share
External POC / Exploit Code
Leaving vuln.today