CVE-2025-7463
📋 TL;DR
A critical buffer overflow vulnerability in Tenda FH1201 routers allows remote attackers to execute arbitrary code by sending specially crafted HTTP POST requests to the /goform/AdvSetWrlsafeset endpoint. This affects users running Tenda FH1201 firmware version 1.2.0.14, potentially giving attackers full control of affected devices.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet enrollment.
Likely Case
Remote code execution allowing attackers to reconfigure router settings, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering or in isolated network segments.
🎯 Exploit Status
Public exploit details are available, and buffer overflow vulnerabilities in network devices are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda FH1201 routers from internet and critical internal networks
Access Control Lists
linuxBlock HTTP POST requests to /goform/AdvSetWrlsafeset on upstream firewalls
iptables -A FORWARD -p tcp --dport 80 -m string --string "POST /goform/AdvSetWrlsafeset" --algo bm -j DROP
🧯 If You Can't Patch
- Replace vulnerable devices with patched or alternative models
- Implement strict network monitoring for exploitation attempts and anomalous router behavior
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
curl -s http://router-ip/goform/getStatus | grep version or check web interfaceVerify Fix Applied:
Verify firmware version is no longer 1.2.0.14 after update📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/AdvSetWrlsafeset with long mit_ssid parameters
- Router reboot or crash logs
- Unusual configuration changes
Network Indicators:
- HTTP traffic to router on port 80 with POST requests containing buffer overflow patterns
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="/goform/AdvSetWrlsafeset" OR method="POST") AND (param="mit_ssid" AND length>100)🔗 References
- https://candle-throne-f75.notion.site/Tenda-FH1201-formWrlsafeset-228df0aa118580a3b0dcd29972efbf0e
- https://vuldb.com/?ctiid.316114
- https://vuldb.com/?id.316114
- https://vuldb.com/?submit.610174
- https://www.tenda.com.cn/
- https://candle-throne-f75.notion.site/Tenda-FH1201-formWrlsafeset-228df0aa118580a3b0dcd29972efbf0e
