CVE-2025-7805
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH451 routers allows remote attackers to execute arbitrary code by manipulating the 'delno' parameter in the PPTPUserSetting function. This affects Tenda FH451 version 1.0.0.9 specifically. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda FH451
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Remote code execution resulting in device takeover, credential theft, network traffic interception, and denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal exploitation risk remains.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known at this time
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. If an update is available, download the latest firmware. 3. Access the router's web interface. 4. Navigate to the firmware upgrade section. 5. Upload and apply the new firmware. 6. Reboot the router after installation.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's web interface by disabling remote management features.
Access router web interface > Advanced Settings > Remote Management > Disable
Network segmentation and firewall rules
linuxIsolate affected routers in a separate network segment and apply strict firewall rules to block access to port 80/443 from untrusted networks.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected devices with models that have available security updates
- Implement network-based intrusion prevention systems (IPS) to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check the router's firmware version via the web interface (typically under System Status or About). If the version is 1.0.0.9, the device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i 'firmware version' or check web interface manuallyVerify Fix Applied:
After updating firmware, verify the version has changed from 1.0.0.9 to a newer version. Test if the /goform/PPTPUserSetting endpoint still accepts malicious 'delno' parameters.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/PPTPUserSetting with long 'delno' parameters
- Multiple failed authentication attempts followed by exploitation attempts
- System logs showing unexpected process crashes or reboots
Network Indicators:
- HTTP traffic to router IP on port 80/443 containing 'delno=' with excessive length
- Unusual outbound connections from router to unknown IPs post-exploitation
SIEM Query:
source="router_logs" AND (url="/goform/PPTPUserSetting" AND (param="delno" AND length>100))🔗 References
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md#poc
- https://vuldb.com/?ctiid.316881
- https://vuldb.com/?id.316881
- https://vuldb.com/?submit.616347
- https://www.tenda.com.cn/
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md#poc
