What is the CVSS score of EUVD-2025-21257?

EUVD-2025-21257 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fh1202 Firmware are affected by EUVD-2025-21257?

A high-severity remote code execution vulnerability has been discovered in Tenda FH1202 wireless routers (version 1.2.0.14(408) and potentially others) that allows unauthenticated attackers to…

Is there a public PoC exploit available for EUVD-2025-21257?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21257. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-21257?

Within 24 hours: Inventory all Tenda FH1202 devices in your environment and isolate affected units from critical network segments; disable WAN management access if enabled. Within 7 days: Contact Tenda for patch availability and timeline; implement network segmentation to restrict router access to authorized administrators only; deploy WAF rules blocking POST requests to /goform/GstDhcpSetSer if accessible from untrusted networks. Within 30 days: Replace affected Tenda FH1202 units with patched firmware versions once available, or substitute with alternative vendor equipment with active security support; conduct network forensics on affected devices for signs of compromise.

Fh1202 Firmware EUVD-2025-21257

| CVE-2025-7528 HIGH

Buffer Overflow (CWE-119)

2025-07-13 cna@vuldb.com

Buffer Overflow Fh1202 Firmware Tenda RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21257

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:57 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 12:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7528 is a critical stack-based buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14(408) affecting the /goform/GstDhcpSetSer endpoint. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'dips' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has public exploit code available and meets criteria for active exploitation risk.

Technical ContextAI

The vulnerability exists in the GstDhcpSetSer function within Tenda FH1202's web management interface, which processes DHCP server configuration parameters. The 'dips' parameter (likely DHCP IP string) lacks proper input validation and boundary checking before being copied into a stack-allocated buffer, triggering CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The affected CPE is cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14:*:*:*:*:*:*:*. Tenda FH1202 is a consumer-grade wireless router/modem device commonly deployed in small office/home office (SOHO) environments. The /goform/ endpoint pattern indicates a CGI-based web interface typical of embedded Linux router firmware.

RemediationAI

Immediate actions: (1) Check Tenda support website for firmware updates beyond version 1.2.0.14(408)—if available, apply immediately via administration panel or management utility; (2) If no patched firmware exists, implement network-level mitigations: restrict access to the FH1202 management interface (/goform/GstDhcpSetSer) to trusted internal IP ranges via firewall rules; (3) Disable remote management features if enabled in device settings; (4) Change default credentials and enforce strong authentication on all Tenda device accounts; (5) Monitor for suspicious DHCP configuration attempts in device logs. Long-term: replace FH1202 with devices from vendors with active security update programs, or implement segmentation to isolate legacy firmware from critical network segments. Vendor advisory should be requested from Tenda at their security contact if not yet published.