CVE-2025-14994
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda FH1201 and FH1206 routers allows remote attackers to execute arbitrary code by manipulating the webSiteId parameter in HTTP requests. This affects devices running vulnerable firmware versions, potentially giving attackers full control over the router. The exploit is publicly available and can be performed without authentication.
💻 Affected Systems
- Tenda FH1201
- Tenda FH1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network traffic interception, credential theft, and lateral movement into connected networks.
Likely Case
Router takeover allowing attackers to modify DNS settings, intercept traffic, deploy malware to connected devices, or create persistent backdoors.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering or if exploit attempts are detected and blocked.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download the latest firmware and upload it via the router's web interface under System Tools > Firmware Upgrade.
🔧 Temporary Workarounds
Network Segmentation and Access Control
allRestrict access to router management interface using firewall rules
Disable Remote Management
allTurn off remote management feature if enabled
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Place routers behind dedicated firewalls with strict inbound filtering rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status > Device InformationCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version has been updated to a version later than the affected ones📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/webtypelibrary with long webSiteId parameters
- Multiple failed authentication attempts followed by buffer overflow patterns
Network Indicators:
- HTTP traffic to router management interface containing unusually long parameter values
- Traffic patterns matching known exploit payloads
SIEM Query:
source="router_logs" AND (url="/goform/webtypelibrary" AND parameter_length>1000) OR (event_type="buffer_overflow" AND device_model="FH1201" OR device_model="FH1206")🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_FH1201/webtyplibrary/webtypelibrary.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_FH1206/webtyplibrary/webtypelibrary.md
- https://vuldb.com/?ctiid.337688
- https://vuldb.com/?id.337688
- https://vuldb.com/?submit.719153
- https://vuldb.com/?submit.719155
- https://www.tenda.com.cn/
