CVE-2025-7550 in FH1201
Summary
by MITRE • 07/14/2025
A vulnerability was found in Tenda FH1201 1.2.0.14(408). It has been classified as critical. Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/14/2025
This critical vulnerability exists in the Tenda FH1201 router firmware version 1.2.0.14(408) within the /goform/GstDhcpSetSer function. The flaw manifests as a stack-based buffer overflow when processing the dips argument, representing a severe security weakness that allows remote exploitation. The vulnerability resides in the web-based administration interface of the device, specifically targeting the GstDhcpSetSer form handler that manages DHCP server settings. This buffer overflow condition occurs when an attacker submits malicious input through the dips parameter, causing the program to write beyond the allocated buffer space on the stack. The exploitation of this vulnerability enables remote code execution capabilities, allowing attackers to gain unauthorized access to the router's underlying system and potentially compromise the entire network infrastructure.
The technical implementation of this vulnerability follows the characteristics of a stack-based buffer overflow as classified under CWE-121, where insufficient bounds checking allows an attacker to overwrite adjacent memory locations including return addresses and function pointers. The remote attack vector means that an unauthenticated attacker can exploit this flaw from outside the network perimeter, making it particularly dangerous for consumer and small office environments where routers are often exposed to the internet. The vulnerability's classification as critical reflects the potential for complete system compromise, as successful exploitation could allow attackers to install malware, modify network configurations, or establish persistent backdoors. This type of vulnerability aligns with ATT&CK technique T1059.007 for remote code execution and T1046 for network service discovery.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it can enable attackers to manipulate the router's core network services including DHCP functionality, DNS resolution, and firewall configurations. An attacker could potentially redirect traffic through malicious servers, create man-in-the-middle attack capabilities, or use the compromised device as a pivot point for attacking internal network resources. The public disclosure of the exploit increases the risk significantly, as it provides attackers with a ready-made tool for targeting vulnerable Tenda FH1201 devices. Organizations and individuals using this specific router model should immediately implement mitigations, as the vulnerability affects a widely deployed consumer-grade networking device with potentially thousands of exposed units on the internet. The presence of this vulnerability in a device's web administration interface makes it particularly attractive to automated attack tools that scan for known exploits.
Mitigation strategies should include immediate firmware updates from Tenda if available, network segmentation to isolate affected devices, and disabling remote administration capabilities where possible. Network administrators should implement intrusion detection systems to monitor for exploitation attempts targeting this specific vulnerability and consider blocking access to the affected web form handler. Device vendors should conduct comprehensive security audits of their products and establish robust vulnerability disclosure processes to prevent similar issues in future releases. The vulnerability demonstrates the critical importance of proper input validation and memory management in embedded systems, particularly those with web-based interfaces that are accessible from untrusted networks.