EUVD-2025-21257
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7528 is a critical stack-based buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14(408) affecting the /goform/GstDhcpSetSer endpoint. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'dips' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has public exploit code available and meets criteria for active exploitation risk.
Technical Context
The vulnerability exists in the GstDhcpSetSer function within Tenda FH1202's web management interface, which processes DHCP server configuration parameters. The 'dips' parameter (likely DHCP IP string) lacks proper input validation and boundary checking before being copied into a stack-allocated buffer, triggering CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The affected CPE is cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14:*:*:*:*:*:*:*. Tenda FH1202 is a consumer-grade wireless router/modem device commonly deployed in small office/home office (SOHO) environments. The /goform/ endpoint pattern indicates a CGI-based web interface typical of embedded Linux router firmware.
Affected Products
[{'vendor': 'Tenda', 'product': 'FH1202', 'affected_versions': ['1.2.0.14(408)'], 'firmware_type': 'Wireless Router/ADSL Modem Firmware', 'cpe': 'cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14:*:*:*:*:*:*:*', 'vulnerability_type': 'Stack-based Buffer Overflow in Web Management Interface'}]
Remediation
Immediate actions: (1) Check Tenda support website for firmware updates beyond version 1.2.0.14(408)—if available, apply immediately via administration panel or management utility; (2) If no patched firmware exists, implement network-level mitigations: restrict access to the FH1202 management interface (/goform/GstDhcpSetSer) to trusted internal IP ranges via firewall rules; (3) Disable remote management features if enabled in device settings; (4) Change default credentials and enforce strong authentication on all Tenda device accounts; (5) Monitor for suspicious DHCP configuration attempts in device logs. Long-term: replace FH1202 with devices from vendors with active security update programs, or implement segmentation to isolate legacy firmware from critical network segments. Vendor advisory should be requested from Tenda at their security contact if not yet published.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today