VulnerabilityAnalyzed
CVE-2025-2994
A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408).
MEDIUM 6.9EPSS 0.65%
Does this matter?
Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects an unknown part of the file /goform/qossetting of the component Web Management Interface. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-284
- Affected
- tenda/fh1202 firmware
- Source
- cna@vuldb.com
References
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-qossetting-1bc53a41781f80a2aa2fde152bf948b5?pvs=4Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.302043Permissions Required, VDB Entry
- https://vuldb.com/?id.302043Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.523417Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/Product
- https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-qossetting-1bc53a41781f80a2aa2fde152bf948b5Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.