CVE-2025-3237
📋 TL;DR
This vulnerability in Tenda FH1202 routers allows attackers to bypass access controls via the /goform/wrlwpsset endpoint, potentially enabling unauthorized configuration changes or system compromise. It affects users running Tenda FH1202 firmware version 1.2.0.14(408). The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover allowing network traffic interception, DNS hijacking, or deployment of persistent malware on the router.
Likely Case
Unauthorized configuration changes, network disruption, or credential theft from connected devices.
If Mitigated
Limited impact if proper network segmentation and firewall rules prevent external access to router management interface.
🎯 Exploit Status
Public exploit details available in disclosed references. Attack requires network access to router management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after update. 4. Verify firmware version changed from 1.2.0.14(408).
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface
Change Default Admin Credentials
allUse strong, unique admin password
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious access to /goform/wrlwpsset endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface. If version is exactly 1.2.0.14(408), device is vulnerable.Check Version:
Check via router web interface at 192.168.0.1 or 192.168.1.1 (default)Verify Fix Applied:
Verify firmware version has changed from 1.2.0.14(408) after update.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/wrlwpsset from unauthorized IPs
- Unusual configuration changes in router logs
Network Indicators:
- Unusual POST requests to router management interface
- Traffic to /goform/wrlwpsset from external sources
SIEM Query:
source="router_logs" AND (uri="/goform/wrlwpsset" OR message="wrlwpsset")