CVE-2025-3236: Tenda FH1202 Auth Bypass Vulnerability

CVE-2025-3236 Overview

CVE-2025-3236 is an improper access control vulnerability [CWE-266] in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in the /goform/VirSerDMZ endpoint of the Web Management Interface. Unauthenticated attackers can reach this endpoint remotely over the network and manipulate DMZ-related configuration without proper authorization checks. The exploit details have been disclosed publicly, increasing the risk of opportunistic abuse against exposed devices.

Critical Impact
Remote, unauthenticated attackers can manipulate the virtual server DMZ configuration on affected Tenda FH1202 routers, weakening network segmentation and exposing internal hosts.

Affected Products

Tenda FH1202 (hardware)
Tenda FH1202 Firmware 1.2.0.14(408)
Web Management Interface component (/goform/VirSerDMZ)

Discovery Timeline

2025-04-04 - CVE-2025-3236 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3236

Vulnerability Analysis

The Tenda FH1202 Web Management Interface exposes the /goform/VirSerDMZ handler, which processes requests related to virtual server and DMZ configuration. The handler does not enforce adequate access control on incoming requests. Attackers reaching the device over the network can submit crafted requests to this endpoint and alter configuration state without authenticating.

Because the DMZ feature forwards traffic from the WAN to a designated internal host, unauthorized modification directly impacts network exposure. An attacker can redirect inbound traffic to hosts of their choosing, undermining the router's segmentation role. The issue is categorized under [CWE-266] Incorrect Privilege Assignment.

Root Cause

The root cause is missing or insufficient authorization enforcement in the VirSerDMZ request handler within the goform interface. The endpoint accepts and processes configuration-changing requests without validating that the caller holds administrative privileges on the device.

Attack Vector

Exploitation occurs over the network against the router's Web Management Interface. No authentication and no user interaction are required. An attacker sends a crafted HTTP request to /goform/VirSerDMZ on the target device. The vulnerability primarily affects integrity of device configuration, as reflected by the CVSS integrity impact. Detailed request construction has been published in the Notion Security Analysis and cataloged in VulDB #303262.

// No verified public exploit code is reproduced here.
// Refer to the Notion Security Analysis and VulDB entries linked above
// for request structure and parameter details.

Detection Methods for CVE-2025-3236

Indicators of Compromise

Unexpected HTTP POST or GET requests to /goform/VirSerDMZ originating from untrusted networks or the WAN interface.
Unauthorized changes to virtual server or DMZ host entries in the router's running configuration.
New port forwarding rules pointing to internal hosts that administrators did not create.

Detection Strategies

Monitor router HTTP access logs for requests to /goform/VirSerDMZ and correlate them with authenticated administrator sessions.
Alert on configuration diffs where DMZ or virtual server entries change outside approved maintenance windows.
Detect exposure of the Web Management Interface on the WAN side using periodic external scans of TCP 80 and 443.

Monitoring Recommendations

Forward router syslog and configuration change events to a central log store for retention and correlation.
Baseline normal administrator source IPs and flag any management traffic from outside that set.
Track inbound flows to hosts referenced by DMZ configuration to detect abuse following unauthorized changes.

How to Mitigate CVE-2025-3236

Immediate Actions Required

Restrict access to the router's Web Management Interface so that it is not reachable from the WAN or untrusted VLANs.
Disable the DMZ and unused virtual server rules on Tenda FH1202 devices until a fix is available.
Change the administrator password and audit existing virtual server and DMZ entries for unauthorized additions.
Segment the router from sensitive internal assets so that DMZ misuse cannot pivot directly to critical systems.

Patch Information

At the time of publication, no vendor advisory or firmware update addressing CVE-2025-3236 has been listed in the CVE record. Administrators should monitor the Tenda Official Website for a firmware release covering FH1202 1.2.0.14(408). Consider replacing affected devices if the vendor does not issue a patch.

Workarounds

Place the router's management interface behind a firewall rule that permits access only from a dedicated management subnet.
Enforce access to the router via VPN and block direct HTTP/HTTPS management traffic from the internet.
Where feasible, replace the FH1202 with a supported device that receives current security updates.

bash

# Example: block WAN-side access to the router web UI using an upstream firewall
# Adjust interface names and router IP to match the environment
iptables -A FORWARD -i wan0 -d 192.168.0.1 -p tcp -m multiport --dports 80,443 -j DROP

# Example: restrict management access to a single admin subnet
iptables -A INPUT -p tcp -m multiport --dports 80,443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP