High severity · published Jul 12, 2025
CVE-2025-7465
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14
8.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fh1201 Firmware · Tenda
1.2.0.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7465
Exploit
https://candle-throne-f75.notion.site/Tenda-FH1201-fromRouteStatic-229df0aa118580ba952bd3f16857b176
Permissions Required
https://vuldb.com/?ctiid.316117
Third Party Advisory
https://vuldb.com/?id.316117
Third Party Advisory
https://vuldb.com/?submit.610389
Product
https://www.tenda.com.cn/
More from Fh1201 Firmware
9.8
CVE-2024-42947
An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request
8.8
CVE-2026-5046
Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow
8.8
CVE-2026-5045
Tenda FH1201 Parameter WrlclientSet stack-based overflow
8.8
CVE-2025-14995
A vulnerability has been found in Tenda FH1201 1.2.0.14(408)
8.8
CVE-2025-14994
A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155)