CVE-2025-2990
📋 TL;DR
This critical vulnerability in Tenda FH1202 routers allows attackers to bypass access controls via the /goform/AdvSetWrlGstset endpoint in the web management interface. Attackers can remotely exploit this to gain unauthorized access to router settings. All users running affected firmware versions are at risk.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to change network settings, intercept traffic, install backdoors, or use the router as a pivot point into the internal network.
Likely Case
Unauthorized access to router administration functions, enabling network configuration changes, DNS hijacking, or credential theft.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong authentication is enforced.
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization probable. The vulnerability requires no authentication and has simple exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Log into router admin panel. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and apply new firmware.
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent remote access to router management interface from the internet
Change Default Credentials
allUse strong, unique passwords for router administration
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for unauthorized access attempts to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under System Status or System Tools. If version is 1.2.0.14(408) or earlier, assume vulnerable.Check Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.2.0.14(408) or check vendor advisory for patched version.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /goform/AdvSetWrlGstset endpoint
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unusual traffic patterns to router management port (typically 80/443)
- External IP addresses accessing router admin interface
SIEM Query:
source_ip=external AND dest_port=80 AND uri_path="/goform/AdvSetWrlGstset"🔗 References
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-AdvSetWrlGstset-1bc53a41781f8057a621c3def0a56069?pvs=4
- https://vuldb.com/?ctiid.302039
- https://vuldb.com/?id.302039
- https://vuldb.com/?submit.523404
- https://www.tenda.com.cn/
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-AdvSetWrlGstset-1bc53a41781f8057a621c3def0a56069
