CVE-2025-6110
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH1201 routers allows remote attackers to execute arbitrary code by manipulating the 'page' argument in the /goform/SafeMacFilter endpoint. This affects all users running Tenda FH1201 firmware version 1.2.0.14(408). Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, and lateral movement into connected networks.
If Mitigated
Denial of service or limited impact if exploit attempts are blocked by network controls.
🎯 Exploit Status
Public exploit details are available, making weaponization straightforward. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available at time of analysis
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after installation.
🔧 Temporary Workarounds
Block web interface access
linuxRestrict access to router web interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable remote management
allTurn off remote administration features in router settings
🧯 If You Can't Patch
- Replace vulnerable routers with patched or different models
- Segment network to isolate vulnerable routers from critical assets
🔍 How to Verify
Check if Vulnerable:
Access router web interface, navigate to System Status or About page, check firmware version matches 1.2.0.14(408).Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from 1.2.0.14(408) to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/SafeMacFilter with large page parameters
- Unusual process creation or memory errors in router logs
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control activity
SIEM Query:
source="router_logs" AND uri="/goform/SafeMacFilter" AND (param_size>1000 OR status=500)