EUVD-2025-21281Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Tenda FH1201 1.2.0.14(408). It has been classified as critical. Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7550 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14(408) affecting the /goform/GstDhcpSetSer endpoint. An authenticated remote attacker can exploit the 'dips' parameter to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. A public proof-of-concept exists, and the vulnerability exhibits active exploitation characteristics with a CVSS score of 8.8.
Technical ContextAI
The vulnerability exists in the fromGstDhcpSetSer function within the Tenda FH1201 router's web management interface. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow. The /goform/GstDhcpSetSer endpoint processes DHCP server configuration parameters without proper input validation, specifically failing to bounds-check the 'dips' parameter before copying it to a fixed-size stack buffer. This allows an attacker to overwrite the stack frame, including return addresses, enabling code execution. Tenda FH1201 (CPE: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14(408)) is an entry-level WiFi router commonly deployed in home and small business environments.
RemediationAI
{'type': 'Patch', 'action': 'Apply latest firmware update from Tenda support portal. Check for firmware versions newer than 1.2.0.14(408). Verify patch availability at https://www.tenda.com.cn/ or regional Tenda support site.', 'priority': 'IMMEDIATE'} {'type': 'Network Segmentation', 'action': 'Restrict access to router web management interface (typically port 80/443) to trusted networks only. Use firewall rules to block external access to /goform/* endpoints.', 'priority': 'HIGH'} {'type': 'Access Control', 'action': 'Change default router credentials from factory defaults. This attack requires PR:L (authenticated access), so strong credentials increase barrier.', 'priority': 'HIGH'} {'type': 'Monitoring', 'action': "Monitor router logs for suspicious POST requests to /goform/GstDhcpSetSer with unusual 'dips' parameter values or repeated failed authentication attempts.", 'priority': 'MEDIUM'} {'type': 'Replacement', 'action': 'If patched firmware is unavailable, consider replacing device with patched model or alternative vendor solution.', 'priority': 'CRITICAL if patch unavailable'}
Share
External POC / Exploit Code
Leaving vuln.today