CVE-2025-2991
📋 TL;DR
This critical vulnerability in Tenda FH1202 routers allows remote attackers to bypass access controls via the web management interface. Attackers can exploit the /goform/AdvSetWrlmacfilter endpoint without proper authentication. All users running the affected firmware version are vulnerable to potential unauthorized access.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router configuration, enabling network traffic interception, DNS hijacking, or deployment of persistent backdoors.
Likely Case
Unauthorized modification of MAC filtering settings, network configuration changes, or exposure of sensitive router information.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router management interface.
🎯 Exploit Status
Exploit details have been publicly disclosed. Attack requires sending crafted requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
Check Tenda website for firmware updates. If update available: 1. Download firmware from official site 2. Log into router admin panel 3. Navigate to System Tools > Firmware Upgrade 4. Upload and install new firmware
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Login to router admin > Advanced > System Tools > Remote Management > Disable
Change Default Admin Credentials
allUse strong unique credentials for router administration
Login to router admin > Advanced > System Tools > Modify Login Password
🧯 If You Can't Patch
- Segment router management interface to internal network only
- Implement firewall rules blocking external access to port 80/443 on router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel: Advanced > System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 1.2.0.14(408) or test if /goform/AdvSetWrlmacfilter endpoint requires proper authentication📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/AdvSetWrlmacfilter
- Multiple failed login attempts followed by successful access
Network Indicators:
- External IP addresses accessing router management interface
- Unusual traffic patterns from router to external IPs
SIEM Query:
source="router.log" AND (uri="/goform/AdvSetWrlmacfilter" OR method="POST" AND uri CONTAINS "/goform/")