CVE-2025-7792
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH451 routers allows remote attackers to execute arbitrary code by manipulating the 'page' parameter in the formSafeEmailFilter function. This affects Tenda FH451 routers running firmware version 1.0.0.9. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda FH451
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and data exfiltration.
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Denial of service or temporary disruption if exploit fails or is detected by security controls.
🎯 Exploit Status
Public proof-of-concept exploit code is available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. If update available, download and flash firmware
3. Reboot router after update
4. Verify firmware version is no longer 1.0.0.9
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to internal network only
🧯 If You Can't Patch
- Replace affected devices with patched or different models
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router web interface or use command 'cat /proc/version' via SSH/Telnet if enabled to verify firmware version is 1.0.0.9Check Version:
Login to router web interface and check firmware version in system settingsVerify Fix Applied:
Verify firmware version is no longer 1.0.0.9 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SafeEmailFilter with manipulated page parameter
- Router crash/reboot logs
- Unusual process execution
Network Indicators:
- HTTP POST requests to router IP on port 80/443 targeting /goform/SafeEmailFilter with abnormal page parameter values
SIEM Query:
source="router_logs" AND (uri="/goform/SafeEmailFilter" OR process="formSafeEmailFilter")🔗 References
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/formSafeEmailFilter.md
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/formSafeEmailFilter.md#poc
- https://vuldb.com/?ctiid.316853
- https://vuldb.com/?id.316853
- https://vuldb.com/?submit.616316
- https://www.tenda.com.cn/
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/formSafeEmailFilter.md
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/formSafeEmailFilter.md#poc
