CVE-2025-7795 in FH451
Summary
by MITRE • 07/18/2025
A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2025
This critical vulnerability exists in the Tenda FH451 router firmware version 1.0.0.9 and specifically affects the /goform/P2pListFilter function within the device's web interface. The flaw manifests as a stack-based buffer overflow that occurs when processing the page argument parameter, representing a severe security weakness that allows remote code execution. The vulnerability resides in the device's handling of user-supplied input through the web form interface, where improper bounds checking enables an attacker to overflow the stack buffer and potentially overwrite critical program execution data. This type of vulnerability falls under CWE-121 which describes stack-based buffer overflow conditions, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter. The remote exploitability means that an attacker can trigger this vulnerability without physical access to the device, making it particularly dangerous for networked environments.
The technical implementation of this vulnerability involves the function fromP2pListFilter processing the page parameter without adequate input validation or buffer size enforcement. When an attacker sends a malformed page argument to the /goform/P2pListFilter endpoint, the firmware fails to properly validate the input length against the allocated stack buffer space. This allows the attacker to write beyond the intended buffer boundaries, potentially overwriting return addresses, function pointers, or other critical stack data structures. The stack-based nature of this overflow means that the attack can manipulate the program's execution flow to redirect control to attacker-controlled code, enabling arbitrary code execution on the vulnerable device. The public disclosure of the exploit increases the risk significantly as it provides threat actors with working attack vectors without requiring additional development effort.
The operational impact of this vulnerability extends beyond simple remote code execution to encompass complete device compromise and potential network infiltration. Once exploited, the attacker gains full administrative control over the Tenda FH451 router, allowing them to modify network settings, intercept traffic, establish persistent backdoors, or use the device as a pivot point for attacking other systems within the local network. The vulnerability affects all devices running the specified firmware version, creating a widespread risk across deployments where these routers are used in residential or small office environments. Given that many users may not regularly update their router firmware, the exploitation window remains extended, making this vulnerability particularly concerning for organizations with legacy network infrastructure. The device's role as a network gateway means that successful exploitation could provide attackers with privileged access to all devices connected to the network, potentially enabling lateral movement and data exfiltration.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term security posture improvements. The primary recommendation involves updating the Tenda FH451 firmware to the latest version that contains patches for this buffer overflow vulnerability. Network administrators should also implement network segmentation to limit the impact of potential exploitation and deploy intrusion detection systems to monitor for exploitation attempts. Additional protective measures include disabling unnecessary web interfaces, implementing strong authentication controls, and regularly monitoring router configurations for unauthorized changes. Organizations should consider network access controls that restrict access to router management interfaces to authorized personnel only, and establish firmware update policies that ensure all network devices remain current with security patches. The vulnerability demonstrates the critical importance of input validation and secure coding practices in embedded systems, highlighting the need for comprehensive security testing throughout the development lifecycle to prevent similar issues in future firmware releases.