Login Request a demo
Medium severity · published Mar 31, 2025
CVE-2025-2990
A vulnerability was found in Tenda FH1202 1.2.0.14(408)
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/AdvSetWrlGstset of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fh1202 Firmware · Tenda
1.2.0.14(408) · source: NVD
Affected product
FF
Fh1202 Firmware
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2990
Exploit
https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-AdvSetWrlGstset-1bc53a41781f8057a621c3def0a56069?pvs=4
Permissions Required
https://vuldb.com/?ctiid.302039
Third Party Advisory
https://vuldb.com/?id.302039
Third Party Advisory
https://vuldb.com/?submit.523404
Product
https://www.tenda.com.cn/
Exploit
https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-AdvSetWrlGstset-1bc53a41781f8057a621c3def0a56069
More from Fh1202 Firmware
9.8
CVE-2024-30589
Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function
9.8
CVE-2024-30587
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function
9.8
CVE-2024-30584
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function
9.8
CVE-2024-30596
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function
9.8
CVE-2024-30593
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function