CVE-2025-7530 in FH1202
Summary
by MITRE • 07/13/2025
A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/14/2025
The vulnerability identified as CVE-2025-7530 represents a critical stack-based buffer overflow flaw in the Tenda FH1202 router firmware version 1.2.0.14(408). This issue resides within the PPTPDClient component, specifically in the fromPptpUserAdd function located at the /goform/PPTPDClient endpoint. The vulnerability stems from inadequate input validation when processing the Username argument, creating an exploitable condition that allows attackers to manipulate memory layout through crafted input parameters.
The technical implementation of this vulnerability follows a classic stack buffer overflow pattern where the Username parameter is processed without proper bounds checking, enabling an attacker to write data beyond the allocated buffer space. This flaw falls under CWE-121 Stack-based Buffer Overflow, which is categorized as a fundamental memory safety issue that can lead to arbitrary code execution. The attack vector is remote, meaning an attacker can exploit this vulnerability without requiring physical access to the device, making it particularly dangerous in networked environments.
The operational impact of CVE-2025-7530 extends beyond simple denial of service scenarios, as the stack-based buffer overflow creates opportunities for privilege escalation and complete system compromise. An attacker who successfully exploits this vulnerability could potentially gain root access to the router, allowing for persistent backdoor installation, network traffic interception, or use as a pivot point for attacking other devices on the local network. The public disclosure of exploitation techniques significantly increases the risk level, as malicious actors can readily implement attacks against unpatched devices.
Security professionals should implement immediate mitigations including firmware updates from Tenda, network segmentation to limit access to the affected device, and monitoring for suspicious traffic patterns on port 1723 which is commonly used by PPTP services. The vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell, and T1071.004 for Application Layer Protocol: DNS, as compromised devices could be used for command execution and data exfiltration. Organizations should also consider implementing intrusion detection systems to monitor for exploitation attempts targeting this specific vulnerability pattern.