CVE-2025-5978
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH1202 routers allows remote attackers to execute arbitrary code by manipulating the 'page' parameter in the fromVirtualSer function. This affects Tenda FH1202 routers running firmware version 1.2.0.14. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point into internal networks.
If Mitigated
Denial of service if exploit fails or crashes the device without achieving code execution.
🎯 Exploit Status
Public exploit details are available, making weaponization likely. The vulnerability requires sending a specially crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for FH1202. 3. Access router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Block External Access
allDisable remote management/WAN access to the router's web interface
Access router admin > Advanced > System Tools > Remote Management > Disable
Network Segmentation
allIsolate vulnerable routers in separate network segments
🧯 If You Can't Patch
- Replace vulnerable routers with patched or different models
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
Check via web interface or SSH if enabled: cat /proc/version or show version commandsVerify Fix Applied:
Verify firmware version is newer than 1.2.0.14 after update📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/VirtualSer with long parameter values
- Router crash/reboot logs
- Unusual configuration changes
Network Indicators:
- HTTP requests to router IP on port 80/443 with abnormal 'page' parameter length
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND (uri="/goform/VirtualSer" AND content_length>1000) OR (event="crash" AND device="FH1202")🔗 References
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-fromVirtualSer-20b53a41781f80b7a6c7e727f93d7d9f?source=copy_link
- https://vuldb.com/?ctiid.311856
- https://vuldb.com/?id.311856
- https://vuldb.com/?submit.592462
- https://www.tenda.com.cn/
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-fromVirtualSer-20b53a41781f80b7a6c7e727f93d7d9f
