{"id":59482,"date":"2025-07-19T03:56:40","date_gmt":"2025-07-19T03:56:40","guid":{"rendered":""},"modified":"2025-08-31T06:32:16","modified_gmt":"2025-08-31T12:32:16","slug":"cve-2025-7550-critical-buffer-overflow-vulnerability-in-tenda-fh1201-1-2-0-14-408","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-7550-critical-buffer-overflow-vulnerability-in-tenda-fh1201-1-2-0-14-408\/","title":{"rendered":"CVE-2025-7550: Critical Buffer Overflow Vulnerability in Tenda FH1201 1.2.0.14(408)<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A critical vulnerability, identified as CVE-2025-7550, has been discovered in Tenda’s FH1201 1.2.0.14(408) firmware. This vulnerability, if exploited, could potentially lead to a system compromise or data leakage. It resides in the function fromGstDhcpSetSer of the file \/goform\/GstDhcpSetSer and can be triggered remotely<\/a> through the improper handling of the argument ‘dips. As Tenda routers are widely used, this vulnerability could potentially impact a large number of users<\/a> and systems.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-7550
\nSeverity: Critical (CVSS: 8.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Tenda FH1201<\/a> | 1.2.0.14(408)<\/p>\n

How the Exploit Works<\/strong><\/p>\n

This vulnerability is a stack-based buffer<\/a> overflow issue. It occurs when the fromGstDhcpSetSer function of the \/goform\/GstDhcpSetSer file in the Tenda FH1201 1.2.0.14(408) firmware fails to properly validate the length of user-supplied data before copying it to a fixed-length, stack-based buffer<\/a>. This flaw could allow an attacker to overwrite the buffer’s content with arbitrary malicious data, potentially leading to the execution of unauthorized<\/a> code or commands.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker could exploit this vulnerability by sending a specially crafted HTTP request<\/a> that contains an oversized ‘dips’ argument. Here’s a simplified, conceptual example of how such an HTTP request might look:<\/p>\n

POST \/goform\/GstDhcpSetSer HTTP\/1.1\nHost: vulnerable-router\nContent-Type: application\/x-www-form-urlencoded\ndips=<\/code><\/pre>\n
In this example, “ would be a string that is long enough to overflow the stack-based buffer in the vulnerable<\/a> function.<\/p>\n
Mitigation and Prevention<\/strong><\/p>\n
Users are advised to apply the vendor-provided patch as soon as possible. If the patch cannot be applied immediately, users can protect themselves by deploying a web application firewall (WAF) or an intrusion detection system (IDS) that can detect and block attempts to exploit this vulnerability<\/a>. However, these are only temporary measures and the ultimate solution is to apply the vendor’s patch.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A critical vulnerability, identified as CVE-2025-7550, has been discovered in Tenda’s FH1201 1.2.0.14(408) firmware. This vulnerability, if exploited, could potentially lead to a system compromise or data leakage. It resides in the function fromGstDhcpSetSer of the file \/goform\/GstDhcpSetSer and can be triggered remotely through the improper handling of the argument ‘dips. As Tenda routers […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[86],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59482","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-buffer-overflow"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t