CVE-2025-7806
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH451 routers allows remote attackers to execute arbitrary code by manipulating the Go/page parameter in the fromSafeClientFilter function. This affects Tenda FH451 firmware version 1.0.0.9. Attackers can exploit this without authentication to potentially take full control of affected routers.
💻 Affected Systems
- Tenda FH451
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or join the device to a botnet.
If Mitigated
Denial of service or limited information disclosure if exploit fails to achieve code execution.
🎯 Exploit Status
Public exploit details are available in GitHub repositories. The vulnerability requires sending specially crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for FH451. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to trusted network segments only
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface at System Status > Firmware Version. If version is 1.0.0.9, device is vulnerable.Check Version:
Check via web interface or SSH if enabled: cat /proc/version or show version commandsVerify Fix Applied:
Verify firmware version has changed from 1.0.0.9 to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/SafeClientFilter
- Multiple failed buffer overflow attempts
- Unexpected router reboots or configuration changes
Network Indicators:
- HTTP traffic to router on port 80/443 with unusual parameter lengths
- Suspicious requests containing buffer overflow patterns
SIEM Query:
source="router_logs" AND (url="/goform/SafeClientFilter" AND (param="Go" OR param="page")) AND size>1000🔗 References
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeClientFilter_Go.md
- https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeClientFilter_page.md
- https://vuldb.com/?ctiid.316882
- https://vuldb.com/?id.316882
- https://vuldb.com/?submit.616348
- https://vuldb.com/?submit.616349
- https://www.tenda.com.cn/
