CVE-2025-2993 Overview
CVE-2025-2993 is an improper access control vulnerability in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in unspecified functionality of the /default.cfg configuration file. Remote attackers can manipulate an argument to bypass access controls without authentication or user interaction. The exploit technique has been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse. The weakness maps to [CWE-266: Incorrect Privilege Assignment].
Critical Impact
Unauthenticated remote attackers can access the router's default configuration file, exposing sensitive device settings and enabling further compromise of the network perimeter.
Affected Products
- Tenda FH1202 hardware appliance
- Tenda FH1202 firmware version 1.2.0.14(408)
- Deployments exposing the device management interface to untrusted networks
Discovery Timeline
- 2025-03-31 - CVE-2025-2993 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2993
Vulnerability Analysis
The Tenda FH1202 exposes the /default.cfg resource without enforcing proper authorization checks. An attacker who manipulates a specific argument on this endpoint bypasses the intended access control boundary. The manipulation reaches privileged functionality that should only be reachable by authenticated administrators. Because the router accepts the request over the network, the flaw is exploitable remotely against any device with its management interface reachable by the attacker. The public disclosure of the exploit details increases the operational risk for exposed devices, and the EPSS model places this issue in the 95th percentile of vulnerabilities by exploitation likelihood.
Root Cause
The root cause is improper privilege assignment on the /default.cfg handler within the FH1202 firmware. The handler does not validate whether the requester holds the required administrative role before processing argument input. This mirrors the [CWE-266] pattern in which a resource grants privileges that exceed the caller's authenticated context. See the Notion Default Config Analysis for the disclosed technical breakdown.
Attack Vector
Exploitation requires network reachability to the router's HTTP management service and does not require credentials or user interaction. An attacker crafts a request to /default.cfg with the manipulated argument identified in the public disclosure. The device processes the request and returns or acts on privileged configuration data. Additional technical details are cataloged in the VulDB entry #302042.
Detection Methods for CVE-2025-2993
Indicators of Compromise
- Unexpected HTTP GET or POST requests to /default.cfg from external or untrusted internal hosts
- Web server or router access logs showing repeated argument-manipulation attempts against the configuration endpoint
- Configuration drift on the FH1202, including unexpected administrative account changes or altered network settings
Detection Strategies
- Deploy network intrusion detection signatures that alert on HTTP requests targeting /default.cfg on Tenda FH1202 devices
- Correlate management-plane traffic with source reputation and time-of-day baselines to identify anomalous access
- Monitor for outbound connections from the router itself, which can indicate a follow-on compromise after initial access
Monitoring Recommendations
- Forward router syslog and management-interface access logs to a centralized analytics platform for retention and hunting
- Baseline administrative HTTP endpoints and alert when new client IPs interact with configuration paths
- Perform periodic firmware and configuration integrity checks against a known-good reference
How to Mitigate CVE-2025-2993
Immediate Actions Required
- Restrict the FH1202 management interface to trusted internal networks and disable WAN-side administration
- Place affected devices behind a firewall that blocks inbound access to HTTP management ports
- Rotate administrative credentials and review router configuration for unauthorized changes
Patch Information
At the time of the last NVD update on 2026-06-17, no vendor-supplied patch is listed in the referenced advisories for firmware 1.2.0.14(408). Consult the Tenda official website for the latest firmware releases and replace end-of-support hardware where fixes are unavailable.
Workarounds
- Segment the FH1202 onto a dedicated management VLAN with strict access control lists
- Block requests to /default.cfg at an upstream reverse proxy or firewall when the device must remain exposed
- Replace the affected model with a supported router if the vendor does not release a firmware update
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
