What is the CVSS score of EUVD-2025-21238?

EUVD-2025-21238 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2025-21238?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21238. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-21238?

Within 24 hours: Identify all Tenda FH451 1.0.0.9 devices in your network inventory and assess their exposure to untrusted networks. Within 7 days: Implement network segmentation to isolate affected devices, restrict administrative access to trusted IPs only, and disable remote management features if operationally feasible. Within 30 days: Replace affected Tenda FH451 devices with alternative vendor hardware, or request firmware updates from Tenda for patched versions if available.

Fh451 Firmware EUVD-2025-21238

| CVE-2025-7505 HIGH

Buffer Overflow (CWE-119)

2025-07-12 cna@vuldb.com

Buffer Overflow Tenda Fh451 Firmware

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 3.1 score of 8.8 (High/Critical threshold) reflects severe impact with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack requires network access and low privilege level (authenticated user), indicating internal network compromise or credential theft as precondition. AC:L (Low Complexity) means no special conditions required. The lack of user interaction (UI:N) and unchanged scope (S:U) indicate direct system compromise. Public POC availability significantly elevates real-world risk—this is no longer theoretical. The combination of (1) authenticated attack vector, (2) public exploit disclosure, (3) widespread consumer product deployment, and (4) complete system compromise potential (RCE via stack overflow) makes this a critical priority despite PR:L requirement. EPSS would likely score >70% given active exploit availability. Organizations managing Tenda FH451 devices should treat this as urgent regardless of internal network assumptions, as router compromise enables lateral movement and persistent access.
Exploit ScenarioDerived	An attacker with valid router credentials (obtained via credential stuffing, phishing, or previous compromise) logs into the Tenda FH451 web management interface. The attacker crafts an HTTP POST request to /goform/L7Prot with an oversized 'page' parameter containing shellcode. The stack buffer overflow allows the attacker to overwrite the return address and redirect execution to injected code. Result: arbitrary code execution with router privileges, enabling persistent access, network traffic interception, DNS spoofing, or use as a pivot point for lateral network attacks. Public POC availability means this requires minimal sophistication—automated exploitation tools likely exist. The authenticated requirement suggests targeting credentials through separate attack vectors or exploiting default/weak credentials common in residential router deployments.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

CVE-2025-7505 is a critical stack-based buffer overflow vulnerability in Tenda FH451 v1.0.0.9 affecting the HTTP POST request handler's L7 protocol filter functionality. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'page' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code has been disclosed and the vulnerability meets CISA KEV criteria for active exploitation risk.

RemediationAI

Apply latest firmware update from Tenda. Check Tenda support portal (support.tenda.com.cn or regional equivalent) for FH451 firmware versions >1.0.0.9. Verify update addresses CVE-2025-7505 in release notes. Access Control: Restrict access to the /goform/L7Prot endpoint using firewall rules. Disable remote management interfaces if not required. Implement strong authentication for router admin access to prevent credential-based attacks. Network Segmentation: Isolate router management interfaces on a separate VLAN or network segment. Monitor for suspicious POST requests to /goform/L7Prot endpoint. Monitoring: Enable router access logs (if available). Monitor for exploitation attempts via malformed 'page' parameter values in HTTP POST requests to L7Prot endpoint. Workaround: Until patch is available, disable L7 protocol filtering feature if operationally acceptable, or restrict administrator access to trusted IPs only.

Affected VersionsENISA

FH451 1.0.0.9

Affected Packages

euvd fh451 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the frmL7ProtForm function within the /goform/L7Prot HTTP endpoint of Tenda FH451 router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The vulnerable parameter 'page' lacks proper bounds checking, allowing an attacker to write beyond allocated stack memory. This affects the HTTP POST request handler component responsible for Layer 7 (application-layer) protocol filtering configuration. The CPE for this product is likely cpe:2.3:o:tenda:fh451_firmware:1.0.0.9. Tenda FH451 is a common residential WiFi router, making this a widespread exposure risk across consumer networks.

Know when Fh451 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Jul 15, 2025 - 17:50 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A remote code execution vulnerability (CVE-2025-7505) affects Tenda FH451 routers with no available patch, allowing unauthenticated attackers to compromise network infrastructure. Organizations using this device model face immediate risk of network breach, data exfiltration, and lateral movement into connected systems, particularly critical if these routers serve as network perimeter devices.

Business Impact: High

Compensating Controls

Deploy WAF rules to block requests to /goform/L7Prot endpoint; restrict HTTP POST access to this URI via network ACLs; segment affected routers on isolated VLANs with limited eastbound traffic; disable HTTP administrative interface if HTTPS is available; monitor for exploitation attempts targeting the L7ProtForm function; consider temporary replacement with alternative network hardware pending vendor patch release.

Threat Intelligence Overview

EPSS Score

0.2%

Top 58% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.