CVE-2025-2990 Overview
CVE-2025-2990 is an improper access control vulnerability in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in the /goform/AdvSetWrlGstset endpoint of the Web Management Interface. Attackers can manipulate the endpoint remotely without authentication or user interaction. The weakness maps to [CWE-266: Incorrect Privilege Assignment] and allows unauthorized modification of guest wireless settings. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed devices.
Critical Impact
Remote, unauthenticated attackers can bypass access controls on the Tenda FH1202 Web Management Interface and manipulate guest wireless configuration through the AdvSetWrlGstset handler.
Affected Products
- Tenda FH1202 router (hardware)
- Tenda FH1202 firmware version 1.2.0.14(408)
- Deployments exposing the Web Management Interface to untrusted networks
Discovery Timeline
- 2025-03-31 - CVE-2025-2990 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2990
Vulnerability Analysis
The vulnerability affects the /goform/AdvSetWrlGstset handler exposed by the Tenda FH1202 Web Management Interface. This handler processes requests related to guest wireless network configuration. The endpoint fails to enforce proper authorization checks before executing privileged actions. As a result, remote attackers can invoke the handler and manipulate settings that should be restricted to authenticated administrators.
The issue is categorized under [CWE-266: Incorrect Privilege Assignment]. Exploitation requires only network reachability to the device management interface. No credentials, tokens, or user interaction are needed to trigger the flaw. Attackers can weaponize the disclosed technique to modify guest network parameters, potentially aiding lateral movement onto the guest wireless segment.
Root Cause
The root cause is missing or insufficient access control enforcement on the AdvSetWrlGstset form handler. The web management stack processes state-changing requests without validating the requester's privilege level. Consumer-grade router firmware frequently relies on session cookies checked at page render time rather than at each API endpoint, leaving /goform/* handlers directly reachable.
Attack Vector
An attacker on the same network as the device — or on the internet if the management interface is exposed — sends a crafted HTTP request to the /goform/AdvSetWrlGstset endpoint. Because the endpoint does not verify the caller's authorization, the request executes with the privileges required to alter guest wireless settings. Publicly available proof-of-concept details in the referenced Notion Security Advisory describe the parameter manipulation used to trigger the issue.
No verified exploit code is republished here. Refer to the VulDB entry #302039 for additional technical context.
Detection Methods for CVE-2025-2990
Indicators of Compromise
- Unexpected HTTP POST requests to /goform/AdvSetWrlGstset originating from untrusted source IPs
- Unauthorized changes to guest SSID, guest network passphrase, or guest access controls in the router configuration
- Router configuration change events with no corresponding administrator login in device logs
Detection Strategies
- Monitor router web management logs for requests to /goform/AdvSetWrlGstset that lack an associated authenticated administrator session
- Baseline the guest wireless configuration and alert when unattended changes occur
- Inspect network traffic to the router management IP for HTTP requests from clients that are not on the administrator allowlist
Monitoring Recommendations
- Forward router syslog and management interface access logs to a centralized log platform for correlation
- Track outbound and inbound requests to TCP ports serving the Web Management Interface, particularly from WAN-facing interfaces
- Alert on any successful configuration change to guest network parameters outside of scheduled maintenance windows
How to Mitigate CVE-2025-2990
Immediate Actions Required
- Disable remote WAN administration on affected Tenda FH1202 devices and restrict management access to a trusted LAN segment
- Place vulnerable devices behind a firewall that blocks external access to the Web Management Interface
- Audit guest wireless configuration for signs of unauthorized modification and reset to known-good settings
- Review the Notion Security Advisory for handler-specific details
Patch Information
No vendor patch has been documented in the enriched CVE data at the time of publication. Consult the Tenda Official Website for firmware updates addressing FH1202 version 1.2.0.14(408). Where a patched firmware release is not yet available, apply compensating network controls and consider replacing the device if it is deployed in security-sensitive environments.
Workarounds
- Restrict access to the router management interface using ACLs so only administrator hosts can reach TCP management ports
- Segment the guest wireless network from internal corporate resources with VLANs and firewall policies
- Change default administrator credentials and disable UPnP and remote management features where feasible
- Where a patched firmware release is not available, isolate or replace affected FH1202 units in production environments
# Configuration example: block external access to the router management interface
# Adjust the WAN interface name and management IP for your environment
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP
# Restrict LAN-side management to a specific administrator host
iptables -A INPUT -s 192.0.2.10 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
