CVE-2025-7596: Tenda FH1205 Buffer Overflow Vulnerability

CVE-2025-7596 Overview

CVE-2025-7596 is a stack-based buffer overflow vulnerability in the Tenda FH1205 wireless router running firmware version 2.0.0.7(775). The flaw resides in the formWifiExtraSet function handling requests to the /goform/WifiExtraSet endpoint. Attackers manipulate the wpapsk_crypto parameter to overflow a fixed-size stack buffer. The weakness is classified under CWE-119 (improper restriction of operations within memory bounds) and CWE-787 (out-of-bounds write). The exploit has been publicly disclosed, increasing exposure for unpatched devices reachable over the network.

Critical Impact
Remote attackers with low privileges can corrupt router memory through a crafted wpapsk_crypto value, enabling arbitrary code execution or device crash on Tenda FH1205 firmware 2.0.0.7(775).

Affected Products

Tenda FH1205 router (hardware)
Tenda FH1205 firmware version 2.0.0.7(775)
Deployments exposing the /goform/WifiExtraSet management endpoint to untrusted networks

Discovery Timeline

2025-07-14 - CVE-2025-7596 published to NVD with public proof-of-concept referenced in VulDB #316295 and the GitHub PoC repository
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7596

Vulnerability Analysis

The Tenda FH1205 web management interface exposes the formWifiExtraSet handler at /goform/WifiExtraSet. The handler reads attacker-controlled HTTP parameters and copies them into local stack buffers without enforcing length checks. Supplying an oversized value for the wpapsk_crypto argument writes past the buffer boundary, corrupting adjacent stack data including the saved return address. Successful exploitation can divert execution to attacker-supplied shellcode or overwrite control structures, granting code execution at the privilege level of the router's HTTP service. The EPSS score is approximately 0.761%.

Root Cause

The root cause is the use of unbounded string copy operations on user input inside formWifiExtraSet. Embedded web servers in consumer routers frequently rely on strcpy or sprintf patterns against fixed-size stack arrays. Without validation of the wpapsk_crypto length prior to the copy, any request exceeding the buffer size triggers stack corruption.

Attack Vector

The vulnerability is exploitable over the network through a single crafted HTTP POST request to /goform/WifiExtraSet. The CVSS vector indicates low attack complexity and requires low privileges, meaning an authenticated session on the management interface is sufficient. Routers with default or weak credentials, or those exposing administration to the WAN side, can be reached directly by remote attackers. The public proof-of-concept hosted in the panda666-888 vuls repository documents the parameter layout required to trigger the overflow.

No verified exploitation code is reproduced here. The referenced advisory describes the request structure: a POST containing the wpapsk_crypto field populated with a long string sufficient to overrun the target buffer and overwrite the saved return address.

Detection Methods for CVE-2025-7596

Indicators of Compromise

HTTP POST requests to /goform/WifiExtraSet containing wpapsk_crypto values exceeding typical cipher identifier lengths (more than 32 bytes)
Unexpected reboots, crashes, or watchdog resets of Tenda FH1205 devices following inbound HTTP traffic
Outbound connections from the router to unfamiliar hosts after web administration activity
Configuration changes to wireless or routing settings that do not correspond to administrator actions

Detection Strategies

Inspect web server and reverse proxy logs for POST requests targeting /goform/WifiExtraSet with abnormally long parameter values
Deploy network IDS signatures that flag HTTP bodies sent to FH1205 management URIs where wpapsk_crypto exceeds expected length
Correlate management-plane HTTP requests with subsequent device availability changes via SNMP or ICMP monitoring

Monitoring Recommendations

Restrict and log all access to router administration interfaces from a dedicated management VLAN
Forward router syslog output to a central SIEM and alert on repeated authentication or HTTP errors followed by reboots
Track firmware versions across the fleet and alert when devices report 2.0.0.7(775) or earlier

How to Mitigate CVE-2025-7596

Immediate Actions Required

Remove WAN-side exposure of the router web administration interface and block inbound TCP 80/443 to management IPs at the upstream firewall
Change default and shared administrator credentials to strong, unique values to limit the low-privilege exploitation precondition
Segment vulnerable FH1205 devices onto isolated management networks until a vendor patch is applied
Audit recent configuration backups to identify unauthorized changes potentially indicative of exploitation

Patch Information

At the time of NVD publication, no official fixed firmware release has been listed in the advisory references. Monitor the Tenda official website and the VulDB entry for #316295 for vendor updates. Apply firmware updates from Tenda as soon as they become available and validate the installed version after the update.

Workarounds

Disable remote (WAN) web management on the FH1205 and require LAN-side administration only
Place an upstream firewall or reverse proxy in front of the router that drops oversized POST bodies to /goform/WifiExtraSet
Replace end-of-life or unsupported FH1205 units with a currently supported router model where feasible

bash

# Example upstream firewall rule (iptables) blocking external access
# to the FH1205 management interface
iptables -A FORWARD -d <router_lan_ip> -p tcp --dport 80 -m conntrack \
  --ctstate NEW -j DROP
iptables -A FORWARD -d <router_lan_ip> -p tcp --dport 443 -m conntrack \
  --ctstate NEW -j DROP