CVE-2025-2994 Overview
CVE-2025-2994 is an improper access control vulnerability affecting Tenda FH1202 routers running firmware version 1.2.0.14(408). The flaw resides in the /goform/qossetting endpoint of the Web Management Interface. Unauthenticated remote attackers can reach this endpoint over the network and manipulate Quality of Service (QoS) settings without proper authorization checks. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed devices. This weakness maps to CWE-266: Incorrect Privilege Assignment and impacts the integrity of router configuration.
Critical Impact
Remote unauthenticated attackers can alter QoS configuration on Tenda FH1202 devices through the /goform/qossetting endpoint, degrading network performance or shaping traffic to their advantage.
Affected Products
- Tenda FH1202 router hardware
- Tenda FH1202 firmware version 1.2.0.14(408)
- Web Management Interface component (/goform/qossetting)
Discovery Timeline
- 2025-03-31 - CVE-2025-2994 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2994
Vulnerability Analysis
The Tenda FH1202 exposes a Web Management Interface that includes a QoS configuration handler at /goform/qossetting. The handler fails to enforce proper access control before processing requests. As a result, an attacker with network reachability to the management interface can invoke the endpoint and modify router QoS parameters without valid credentials.
This class of flaw is common in small office/home office (SOHO) routers where /goform/* handlers rely on implicit session context rather than explicit authorization checks. The Common Weakness Enumeration classifies this behavior under CWE-266, reflecting an incorrect privilege assignment on a sensitive administrative function. The EPSS probability for this CVE is 0.597%.
Root Cause
The root cause is missing or insufficient authorization enforcement on the /goform/qossetting request handler. The router accepts and applies QoS parameter changes based on request content alone, without verifying that the requester holds administrative privileges. Attackers who can send HTTP requests to the device management interface can manipulate settings that should be restricted to authenticated administrators.
Attack Vector
The vulnerability is exploitable remotely over the network. An attacker crafts an HTTP request targeting the /goform/qossetting endpoint on the affected device and submits manipulated QoS parameters. No user interaction and no prior authentication are required. Exploitation is most impactful when the Web Management Interface is exposed to untrusted networks or when the attacker has already established a foothold on the local network.
No verified proof-of-concept code is published in the NVD references. Technical details of the endpoint behavior are documented in the Notion QoS Settings Guide and tracked in VulDB entry #302043.
Detection Methods for CVE-2025-2994
Indicators of Compromise
- Unexpected HTTP POST or GET requests to /goform/qossetting from non-administrative source addresses.
- Unauthorized changes to QoS rules, bandwidth caps, or traffic priorities on Tenda FH1202 devices.
- Web management access log entries lacking a corresponding authenticated administrator session.
Detection Strategies
- Inspect router HTTP access logs for requests to /goform/qossetting and correlate with authenticated admin sessions.
- Monitor for configuration drift on Tenda FH1202 devices, focusing on QoS policy changes outside change windows.
- Deploy network-based signatures on IDS/IPS appliances that flag inbound requests to Tenda /goform/* endpoints from untrusted segments.
Monitoring Recommendations
- Forward router syslog and HTTP audit events to a centralized logging platform for continuous review.
- Alert on any WAN-side connection attempts to the router management interface on TCP ports 80 and 443.
- Track baseline QoS configuration in configuration management and alert on unauthorized deltas.
How to Mitigate CVE-2025-2994
Immediate Actions Required
- Disable remote WAN access to the Tenda FH1202 Web Management Interface and restrict management to trusted LAN segments only.
- Segment the router management VLAN so that only administrative hosts can reach /goform/qossetting.
- Change default and shared administrative credentials and audit recent QoS configuration changes for tampering.
Patch Information
No vendor advisory or firmware update has been published in the NVD references for CVE-2025-2994 at the time of writing. Administrators should monitor the Tenda official website for firmware updates that address the /goform/qossetting access control weakness.
Workarounds
- Place the Tenda FH1202 behind a firewall that blocks inbound HTTP/HTTPS traffic to the router management interface.
- Apply access control lists (ACLs) that permit management traffic only from known administrator IP addresses.
- Where feasible, replace end-of-support SOHO routers with devices that receive active security maintenance.
# Example firewall rule to restrict router management interface access
# Allow only trusted admin subnet 10.10.10.0/24 to reach the router at 192.168.0.1
iptables -A FORWARD -s 10.10.10.0/24 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
