What is the CVSS score of EUVD-2025-21238?

EUVD-2025-21238 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Fh451 Firmware are affected by EUVD-2025-21238?

A remote code execution vulnerability (CVE-2025-7505) affects Tenda FH451 routers with no available patch, allowing unauthenticated attackers to compromise network infrastructure.

Is there a public PoC exploit available for EUVD-2025-21238?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21238. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-21238?

Within 24 hours: Identify all Tenda FH451 1.0.0.9 devices in your network inventory and assess their exposure to untrusted networks. Within 7 days: Implement network segmentation to isolate affected devices, restrict administrative access to trusted IPs only, and disable remote management features if operationally feasible. Within 30 days: Replace affected Tenda FH451 devices with alternative vendor hardware, or request firmware updates from Tenda for patched versions if available.

Fh451 Firmware EUVD-2025-21238

| CVE-2025-7505 HIGH

Buffer Overflow (CWE-119)

2025-07-12 cna@vuldb.com

Buffer Overflow Tenda Fh451 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21238

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 17:50 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7505 is a critical stack-based buffer overflow vulnerability in Tenda FH451 v1.0.0.9 affecting the HTTP POST request handler's L7 protocol filter functionality. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'page' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code has been disclosed and the vulnerability meets CISA KEV criteria for active exploitation risk.

Technical ContextAI

The vulnerability exists in the frmL7ProtForm function within the /goform/L7Prot HTTP endpoint of Tenda FH451 router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The vulnerable parameter 'page' lacks proper bounds checking, allowing an attacker to write beyond allocated stack memory. This affects the HTTP POST request handler component responsible for Layer 7 (application-layer) protocol filtering configuration. The CPE for this product is likely cpe:2.3:o:tenda:fh451_firmware:1.0.0.9. Tenda FH451 is a common residential WiFi router, making this a widespread exposure risk across consumer networks.

RemediationAI

Apply latest firmware update from Tenda. Check Tenda support portal (support.tenda.com.cn or regional equivalent) for FH451 firmware versions >1.0.0.9. Verify update addresses CVE-2025-7505 in release notes. Access Control: Restrict access to the /goform/L7Prot endpoint using firewall rules. Disable remote management interfaces if not required. Implement strong authentication for router admin access to prevent credential-based attacks. Network Segmentation: Isolate router management interfaces on a separate VLAN or network segment. Monitor for suspicious POST requests to /goform/L7Prot endpoint. Monitoring: Enable router access logs (if available). Monitor for exploitation attempts via malformed 'page' parameter values in HTTP POST requests to L7Prot endpoint. Workaround: Until patch is available, disable L7 protocol filtering feature if operationally acceptable, or restrict administrator access to trusted IPs only.