CVE-2025-7549 in FH1201
Summary
by MITRE • 07/14/2025
A vulnerability was found in Tenda FH1201 1.2.0.14(408) and classified as critical. This issue affects the function frmL7ProtForm of the file /goform/L7Prot. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/14/2025
This critical vulnerability in Tenda FH1201 router firmware version 1.2.0.14(408) represents a stack-based buffer overflow flaw within the frmL7ProtForm function of the /goform/L7Prot file. The vulnerability arises from improper input validation when processing the page argument parameter, creating a condition where maliciously crafted input can exceed the allocated buffer space on the stack. The attack vector is remotely exploitable, meaning an attacker does not require physical access to the device to initiate the vulnerability. This remote exploitability significantly increases the attack surface and potential impact, as adversaries can target vulnerable devices over the network without requiring direct access to the router's administrative interface.
The technical implementation of this vulnerability demonstrates a classic stack-based buffer overflow where the page argument parameter lacks adequate bounds checking or input sanitization. When an attacker sends a specially crafted request containing an oversized page parameter to the vulnerable endpoint, the excessive data overflows into adjacent stack memory locations, potentially corrupting the return address or other critical stack variables. This type of vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a high-risk vulnerability due to its potential for arbitrary code execution. The exploitability of this flaw is further exacerbated by the fact that it has been publicly disclosed, making it immediately available to threat actors without requiring advanced exploitation techniques.
The operational impact of this vulnerability extends beyond simple denial of service or data corruption, as it represents a potential path to complete system compromise. An attacker who successfully exploits this buffer overflow could potentially execute arbitrary code with the privileges of the web server process, which typically runs with elevated permissions on network devices. This could lead to full administrative control over the router, enabling attackers to modify network configurations, redirect traffic, establish persistent backdoors, or use the compromised device as a pivot point for attacking other systems within the local network. The implications are particularly severe for enterprise environments where routers serve as critical network infrastructure components, as they may be used to facilitate lateral movement attacks or to create persistent access points within the network.
Mitigation strategies for this vulnerability should prioritize immediate firmware updates from Tenda, as the manufacturer would need to implement proper input validation and bounds checking for the page parameter in the frmL7ProtForm function. Network administrators should also implement network segmentation and access controls to limit exposure to this vulnerability, particularly by restricting remote administrative access to router interfaces. Additional defensive measures include deploying web application firewalls to monitor and filter suspicious requests targeting the vulnerable /goform/L7Prot endpoint, implementing network monitoring to detect anomalous traffic patterns, and conducting regular vulnerability assessments to identify other potential attack vectors within the network infrastructure. Organizations should also consider disabling unnecessary web management interfaces when not actively required for administration, as this reduces the attack surface and limits potential exploitation opportunities. The vulnerability's classification as critical according to CVSS scoring systems indicates that immediate remediation is essential to prevent potential compromise of network infrastructure.