What is the CVSS score of EUVD-2025-21255?

EUVD-2025-21255 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fh1202 Firmware are affected by EUVD-2025-21255?

A critical remote code execution vulnerability affects Tenda FH1202 routers (version 1.2.0.14(408), with public exploit code now available and no patch currently available.

Is there a public PoC exploit available for EUVD-2025-21255?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21255. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-21255?

Within 24 hours: Identify all Tenda FH1202 devices in your environment and isolate affected units from critical networks if possible. Within 7 days: Implement network segmentation to restrict administrative access to these devices and deploy WAF rules blocking malicious PPPOEPassword payloads to the /goform/AdvSetWan endpoint. Within 30 days: Plan device replacement with alternative vendors or monitor for vendor patch availability; contact Tenda for patch timeline and consider deploying intrusion detection signatures for this vulnerability.

Fh1202 Firmware EUVD-2025-21255

| CVE-2025-7527 HIGH

Buffer Overflow (CWE-119)

2025-07-13 cna@vuldb.com

Buffer Overflow Fh1202 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21255

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:57 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 11:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects the function fromAdvSetWan of the file /goform/AdvSetWan. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical stack-based buffer overflow vulnerability exists in Tenda FH1202 firmware version 1.2.0.14(408) affecting the /goform/AdvSetWan endpoint. An authenticated remote attacker can overflow the PPPOEPassword parameter to achieve arbitrary code execution with full system privileges (confidentiality, integrity, and availability compromise). Public exploit code is available and the vulnerability meets criteria for active exploitation risk.

Technical ContextAI

The vulnerability resides in the fromAdvSetWan function within Tenda FH1202 router firmware, which processes WAN configuration parameters via HTTP POST requests to /goform/AdvSetWan. The PPPOEPassword parameter lacks proper input validation and length checking before being copied into a stack-allocated buffer, violating CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Tenda FH1202 is a wireless router device running proprietary firmware. The affected CPE context is likely: cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*. Stack-based buffer overflows in embedded router firmware typically allow attackers to overwrite return addresses and execute shellcode within the kernel or privileged userland process context.

RemediationAI

{'type': 'Patch', 'action': "Upgrade Tenda FH1202 firmware to version 1.2.0.15 or later (if available). Check Tenda's official support page for FH1202 security updates at https://www.tenda.com.cn/download/", 'priority': 'IMMEDIATE'} {'type': 'Workaround - Network Segmentation', 'action': "Restrict administrative access to the router's web interface (port 80/443) to trusted internal networks only. Block external WAN access via firewall rules.", 'priority': 'HIGH'} {'type': 'Workaround - Credential Management', 'action': 'Change default admin credentials to strong, unique passwords to reduce likelihood of authenticated exploit. However, this is NOT a complete mitigation as authenticated users on the network could still exploit.', 'priority': 'MEDIUM'} {'type': 'Mitigation - Network Monitoring', 'action': 'Monitor for suspicious HTTP POST requests to /goform/AdvSetWan with unusually long PPPOEPassword values or binary payloads. Alert on firmware crashes/reboots.', 'priority': 'MEDIUM'} {'type': 'Device Replacement', 'action': 'If patch unavailable, consider replacing FH1202 with newer router models from reputable vendors with active security support.', 'priority': 'HIGH'}