CVE-2025-2995 Overview
CVE-2025-2995 is an improper access control vulnerability in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in the /goform/SysToolChangePwd endpoint of the Web Management Interface. Attackers can reach this endpoint over the network without authentication and manipulate password change functionality. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed devices. The weakness is classified under [CWE-266: Incorrect Privilege Assignment].
Critical Impact
Remote attackers can abuse the SysToolChangePwd endpoint to alter administrative credentials on affected Tenda FH1202 routers, undermining device integrity.
Affected Products
- Tenda FH1202 router hardware
- Tenda FH1202 firmware version 1.2.0.14(408)
- Web Management Interface component (/goform/SysToolChangePwd)
Discovery Timeline
- 2025-03-31 - CVE-2025-2995 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2995
Vulnerability Analysis
The vulnerability affects the SysToolChangePwd handler exposed through the router's Web Management Interface. This handler processes password change requests but fails to enforce proper access controls before performing the operation. Remote attackers can send crafted HTTP requests to /goform/SysToolChangePwd without meeting authentication or authorization requirements.
The attack requires no user interaction and can be executed over the network. Because the endpoint governs administrative credentials, successful exploitation compromises the integrity of the router's authentication state. The public disclosure of exploit details lowers the barrier to weaponization against internet-exposed FH1202 devices.
Root Cause
The root cause is improper access control on a sensitive administrative endpoint. The SysToolChangePwd function does not adequately validate the caller's session, privileges, or origin before processing password modification requests. This aligns with [CWE-266], where a component grants privileges that should be restricted to authenticated administrators.
Attack Vector
Exploitation is remote and network-based. An attacker who can reach the router's Web Management Interface — either on the LAN or on the WAN when management is exposed — issues an HTTP request to /goform/SysToolChangePwd. The endpoint processes the request without enforcing the expected access checks, allowing the attacker to influence password state on the device.
No verified proof-of-concept code is published in the enriched data. Technical details are documented in the Notion write-up on Tenda FH1202 SysToolChangePwd and the VulDB entry #302044.
Detection Methods for CVE-2025-2995
Indicators of Compromise
- Unexpected HTTP POST or GET requests targeting /goform/SysToolChangePwd on Tenda FH1202 devices
- Administrative password changes on the router that do not correlate with authorized administrator activity
- Loss of access to the Web Management Interface using known-good credentials
- Web management sessions originating from unexpected external or internal IP addresses
Detection Strategies
- Inspect network traffic between clients and the router for requests to /goform/SysToolChangePwd, particularly from unauthenticated or unknown sources
- Correlate router configuration change events with authenticated session logs to identify unauthorized modifications
- Alert on repeated HTTP requests to /goform/ endpoints from non-administrator hosts
Monitoring Recommendations
- Enable logging on network segments hosting the FH1202 and forward logs to a centralized SIEM for analysis
- Monitor for administrator lockout events and unexpected authentication failures on the router
- Track WAN-side connections to router management ports (typically TCP/80 or TCP/443) and treat unsolicited access as suspicious
How to Mitigate CVE-2025-2995
Immediate Actions Required
- Restrict access to the Web Management Interface to trusted management VLANs or hosts only
- Disable remote (WAN-side) management on the FH1202 until a fix is confirmed
- Rotate administrator credentials and audit device configuration for unauthorized changes
- Isolate FH1202 devices behind a firewall that blocks inbound access to /goform/ URIs from untrusted networks
Patch Information
As of the last NVD update on 2026-06-17, no vendor advisory or firmware patch is listed in the enriched data. Consult the Tenda official website for firmware updates and refer to the VulDB CTI entry for tracking remediation status. Organizations should plan replacement of end-of-life devices when a fix is not released.
Workarounds
- Place the router behind an upstream firewall that denies inbound HTTP/HTTPS to the management interface from untrusted zones
- Restrict management access with source-IP allowlists on any intermediate network device
- Consider replacing affected FH1202 units with a supported, actively maintained router model if no patch becomes available
# Example upstream firewall rule to block external access to router management
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -m iprange ! --src-range <admin_subnet> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -m iprange ! --src-range <admin_subnet> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
