Login Request a demo
Medium severity · published Mar 31, 2025
CVE-2025-2995
Tenda FH1202 Web Management Interface SysToolChangePwd access control
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolChangePwd of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FH
FH1202 · Tenda
1.2.0.14(408) · source: vendor
FF
Fh1202 Firmware · Tenda
1.2.0.14(408) · source: NVD
Affected product
FH
FH1202
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2995
Exploit
https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-SysToolChangePwd-1bc53a41781f809b95a4efb617090d3c?pvs=4
Permissions Required
https://vuldb.com/?ctiid.302044
Third Party Advisory
https://vuldb.com/?id.302044
Third Party Advisory
https://vuldb.com/?submit.523418
Product
https://www.tenda.com.cn/
Exploit
https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-SysToolChangePwd-1bc53a41781f809b95a4efb617090d3c
More from FH1202
9.8
CVE-2024-30593
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function
9.8
CVE-2024-30584
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function
9.8
CVE-2023-38932
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function
9.8
CVE-2023-38938
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter at /L7Im
9.8
CVE-2023-38939
Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function