CVE-2025-14994

Summary

A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the component HTTP Request Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Affected Software

VendorProductVersion RangeStatus
TendaFH12011.2.0.8(8155)affected
TendaFH12011.2.0.14(408)affected
TendaFH12061.2.0.8(8155)affected
TendaFH12061.2.0.14(408)affected

Weaknesses

  • CWE-121: Stack-based Buffer Overflow
  • CWE-119: Memory Corruption

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References