High severity · published Jul 12, 2025
CVE-2025-7465
Tenda FH1201 HTTP POST Request fromRouteStatic buffer overflow
8.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FH
FH1201 · Tenda
1.2.0.14 · source: vendor
FF
Fh1201 Firmware · Tenda
1.2.0.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7465
Exploit
https://candle-throne-f75.notion.site/Tenda-FH1201-fromRouteStatic-229df0aa118580ba952bd3f16857b176
Permissions Required
https://vuldb.com/?ctiid.316117
Third Party Advisory
https://vuldb.com/?id.316117
Third Party Advisory
https://vuldb.com/?submit.610389
Product
https://www.tenda.com.cn/
More from FH1201
9.8
CVE-2024-41468
Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand
9.8
CVE-2024-41461
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient
8.8
CVE-2025-14994
Tenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflow
8.8
CVE-2025-7551
Tenda FH1201 PPTPDClient fromPptpUserAdd stack-based overflow
8.8
CVE-2025-7550
Tenda FH1201 GstDhcpSetSer fromGstDhcpSetSer stack-based overflow