CVE-2025-6110: Tenda FH1201 Buffer Overflow Vulnerability

CVE-2025-6110 Overview

CVE-2025-6110 is a stack-based buffer overflow vulnerability in the Tenda FH1201 router running firmware version 1.2.0.14(408). The flaw resides in the /goform/SafeMacFilter endpoint, where the page parameter is processed without proper bounds checking. Attackers can trigger the overflow remotely over the network with low privileges, corrupting stack memory in the router's HTTP service. The vulnerability has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed devices. Successful exploitation can lead to denial of service or arbitrary code execution within the router's management process, impacting confidentiality, integrity, and availability of the device.

Critical Impact
Remote attackers can send a crafted request to /goform/SafeMacFilter to overflow the stack and potentially execute arbitrary code on affected Tenda FH1201 routers.

Affected Products

Tenda FH1201 router (hardware)
Tenda FH1201 firmware version 1.2.0.14(408)
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-06-16 - CVE-2025-6110 published to the National Vulnerability Database
2025-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6110

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] mapped under [CWE-119] and [CWE-787]. It is reachable through the /goform/SafeMacFilter handler in the embedded httpd binary of the Tenda FH1201. The handler reads the page HTTP parameter from a client request and copies it into a fixed-size stack buffer without validating length. An authenticated user with low privileges can submit an overly long page value to overwrite the saved return address and adjacent stack data. The EPSS probability is 0.895% with a percentile of 76.01, indicating measurable interest in exploitation tooling for this class of Tenda flaws.

Root Cause

The root cause is missing input length validation on the page parameter before it is written into a stack buffer. The handler relies on unsafe string copying routines common in embedded goform handlers, where attacker-controlled HTTP form data flows directly into bounded stack storage. No canary or address space layout randomization is consistently enforced on this MIPS-based platform, making memory corruption straightforward to weaponize.

Attack Vector

An attacker reaches the vulnerable endpoint over the network by sending an HTTP POST or GET request to /goform/SafeMacFilter with a malformed page argument. The attack requires authenticated access to the web management interface. Devices that expose management to the WAN, reuse default credentials, or are accessible through chained CSRF and cross-site scripting flaws become viable targets. See the Notion security analysis and VulDB entry #312579 for the disclosed technical write-up.

// No verified exploit code is published in the enriched data set.
// The vulnerability is triggered by sending an HTTP request to
// /goform/SafeMacFilter with an oversized `page` parameter that
// overflows a fixed-size stack buffer in the router's httpd binary.

Detection Methods for CVE-2025-6110

Indicators of Compromise

HTTP requests to /goform/SafeMacFilter containing a page parameter exceeding several hundred bytes or containing non-printable shellcode bytes.
Repeated crashes or unexpected reboots of the Tenda FH1201 httpd process recorded in syslog or remote logging targets.
Outbound connections from the router to unfamiliar IP addresses following management interface activity.

Detection Strategies

Inspect web server and management logs for anomalous URI parameters targeting /goform/SafeMacFilter.
Deploy network IDS signatures that flag oversized page values in HTTP requests to Tenda administrative endpoints.
Correlate authentication events with subsequent device reboots to identify post-exploitation crash loops.

Monitoring Recommendations

Forward router syslog to a centralized SIEM and alert on httpd segmentation faults or watchdog-triggered reboots.
Baseline normal administrative traffic to the FH1201 and alert on requests from non-management subnets.
Monitor DNS and outbound traffic from the router segment for unexpected callbacks indicative of post-exploitation activity.

How to Mitigate CVE-2025-6110

Immediate Actions Required

Restrict access to the Tenda FH1201 web management interface to trusted internal management VLANs only.
Disable remote WAN administration on the device until a vendor patch is verified.
Rotate administrative credentials and enforce strong, unique passwords to limit the low-privilege precondition required for exploitation.
Inventory all Tenda FH1201 devices running firmware 1.2.0.14(408) and prioritize them for replacement or isolation.

Patch Information

At the time of publication, no fixed firmware version is referenced in the NVD record or the Tenda official website. Track vendor advisories and apply patched firmware as soon as it becomes available. If the vendor does not issue a fix, plan device replacement for production environments.

Workarounds

Block inbound HTTP and HTTPS traffic to the router management port from untrusted networks at the upstream firewall.
Place the FH1201 behind a network segmentation boundary that permits only administrative workstations to reach /goform/ endpoints.
Apply ACLs that drop HTTP requests with abnormally long query parameters targeting the device's management interface.

bash

# Example upstream firewall rule restricting management access
# Replace 10.10.0.0/24 with your administrative subnet
# and 192.0.2.10 with the FH1201 management IP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 \
  ! -s 10.10.0.0/24 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 \
  ! -s 10.10.0.0/24 -j DROP