Login Request a demo
High severity · published Jul 12, 2025
CVE-2025-7468
A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical
8.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerability affects the function fromSafeUrlFilter of the file /goform/fromSafeUrlFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fh1201 Firmware · Tenda
1.2.0.14 · source: NVD
Affected product
FF
Fh1201 Firmware
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7468
Exploit
https://candle-throne-f75.notion.site/Tenda-FH1201-fromSafeUrlFilter-229df0aa118580ceb3e4f54d22814c40
Permissions Required
https://vuldb.com/?ctiid.316120
Third Party Advisory
https://vuldb.com/?id.316120
Third Party Advisory
https://vuldb.com/?submit.610394
Product
https://www.tenda.com.cn/
More from Fh1201 Firmware
9.8
CVE-2024-42947
An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request
8.8
CVE-2026-5046
Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow
8.8
CVE-2026-5045
Tenda FH1201 Parameter WrlclientSet stack-based overflow
8.8
CVE-2025-14995
Tenda FH1201 SetIpBind sprintf stack-based overflow
8.8
CVE-2025-14994
Tenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflow