CVE-2025-2991: Tenda FH1202 Auth Bypass Vulnerability

CVE-2025-2991 Overview

CVE-2025-2991 is an improper access control vulnerability [CWE-266] in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in an unspecified function of the /goform/AdvSetWrlmacfilter endpoint within the Web Management Interface. Attackers can reach the vulnerable endpoint over the network without authentication and manipulate wireless MAC filter settings. Public disclosure of the exploit details raises the risk of opportunistic abuse against exposed devices. The vulnerability carries a CVSS 4.0 score of 6.9 and an EPSS probability of 0.582%.

Critical Impact
Remote, unauthenticated attackers can abuse the AdvSetWrlmacfilter endpoint to alter wireless MAC filtering controls on affected Tenda FH1202 devices.

Affected Products

Tenda FH1202 hardware appliance
Tenda FH1202 firmware version 1.2.0.14(408)
Deployments exposing the Web Management Interface to untrusted networks

Discovery Timeline

2025-03-31 - CVE-2025-2991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2991

Vulnerability Analysis

The Tenda FH1202 exposes the /goform/AdvSetWrlmacfilter handler through its Web Management Interface. This handler manages wireless MAC address filter configuration, a security control used to allow or deny client associations. The firmware fails to enforce proper access controls on requests reaching this endpoint. As a result, an attacker with network reachability to the router's management interface can invoke the handler and manipulate filter state without valid credentials. The disclosure references note the exploit has been made public, increasing the probability of automated scanning and abuse against internet-exposed instances.

Root Cause

The root cause is improper enforcement of access control [CWE-266] on a privileged administrative endpoint. The AdvSetWrlmacfilter function does not verify the requesting session's authorization state or role before executing configuration changes. Assignment of privileges to unauthenticated callers allows sensitive router configuration to be altered by anyone who can reach the HTTP service.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker crafts an HTTP request targeting /goform/AdvSetWrlmacfilter on a reachable Tenda FH1202 device. Because the endpoint accepts the request without validating the caller, submitted parameters can modify MAC filter policy. Devices exposing the management interface to the WAN or shared LAN segments are directly reachable and therefore most at risk. Refer to the Notion Security Advisory and VulDB #302040 for endpoint-level technical detail.

Detection Methods for CVE-2025-2991

Indicators of Compromise

Unexpected HTTP POST or GET requests to /goform/AdvSetWrlmacfilter originating from external or unmanaged source IPs.
Unexplained changes to wireless MAC address filtering rules on Tenda FH1202 devices.
Router configuration events occurring outside of scheduled administrative windows.

Detection Strategies

Inspect router HTTP access logs and network flow data for requests to /goform/AdvSetWrlmacfilter from unauthorized clients.
Deploy network intrusion detection signatures matching the vulnerable URI path against Tenda FH1202 management interfaces.
Correlate configuration change events with authenticated administrative sessions to identify unauthenticated modifications.

Monitoring Recommendations

Monitor egress and ingress traffic to router management ports (typically TCP/80 and TCP/443) for anomalous sources.
Baseline expected administrative activity and alert on off-hours or scripted access patterns targeting /goform/* endpoints.
Track firmware version inventory to identify FH1202 devices still running 1.2.0.14(408).

How to Mitigate CVE-2025-2991

Immediate Actions Required

Restrict access to the Web Management Interface so that only trusted management VLANs or hosts can reach the router.
Disable remote WAN-side administration on Tenda FH1202 devices where enabled.
Rotate administrative credentials and audit wireless MAC filter rules for unauthorized changes.

Patch Information

At the time of publication, no vendor advisory or fixed firmware release is listed in the NVD references. Consult the Tenda Official Website for firmware update availability and monitor VulDB CTI ID #302040 for updates on remediation status.

Workarounds

Place the FH1202 management interface behind a firewall rule that permits only authorized administrator IP addresses.
Segment the router management plane onto a dedicated VLAN inaccessible from guest or user networks.
Where feasible, replace end-of-support or unpatched FH1202 units with actively maintained hardware.

bash

# Configuration example: restrict router management access at an upstream firewall
iptables -A FORWARD -p tcp -d <FH1202_IP> --dport 80 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <FH1202_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <FH1202_IP> --dport 443 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <FH1202_IP> --dport 443 -j DROP