Details of VAR-202503-2800

ID

VAR-202503-2800

CVE

CVE-2025-2992

TITLE

Shenzhen Tenda Technology Co.,Ltd. of FH1202 Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2025-003179

DESCRIPTION

A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is an unknown functionality of the file /goform/AdvSetWrlsafeset of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of FH1202 There are unspecified vulnerabilities in the firmware.Information may be tampered with

Trust: 1.62

sources: NVD: CVE-2025-2992 // JVNDB: JVNDB-2025-003179

AFFECTED PRODUCTS

vendor:	tenda	model:	fh1202	scope:	eq	version:	1.2.0.14\(408\)	Trust: 1.0
vendor:	tenda	model:	fh1202	scope:	eq	version:	fh1202 firmware 1.2.0.14(408)	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2025-003179 // NVD: CVE-2025-2992

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-2992
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-003179
value:	MEDIUM
Trust: 0.8

cna@vuldb.com:	CVE-2025-2992
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-003179
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2025-2992
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-003179
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2025-003179 // NVD: CVE-2025-2992

PROBLEMTYPE DATA

problemtype:	CWE-266	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-284	Trust: 1.0
problemtype:	Improper permission settings (CWE-266) [ others ]	Trust: 0.8
problemtype:	Inappropriate access control (CWE-284) [ others ]	Trust: 0.8
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-003179 // NVD: CVE-2025-2992

EXTERNAL IDS

db:	NVD	id:	CVE-2025-2992	Trust: 2.6
db:	VULDB	id:	302041	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-003179	Trust: 0.8

sources: JVNDB: JVNDB-2025-003179 // NVD: CVE-2025-2992

REFERENCES

url:	https://lavender-bicycle-a5a.notion.site/tenda-fh1202-advsetwrlsafeset-1bc53a41781f809bb808deffc226401d?pvs=4	Trust: 1.8
url:	https://vuldb.com/?id.302041	Trust: 1.8
url:	https://vuldb.com/?submit.523413	Trust: 1.8
url:	https://www.tenda.com.cn/	Trust: 1.8
url:	https://vuldb.com/?ctiid.302041	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2025-2992	Trust: 0.8

sources: JVNDB: JVNDB-2025-003179 // NVD: CVE-2025-2992

SOURCES

db:	JVNDB	id:	JVNDB-2025-003179
db:	NVD	id:	CVE-2025-2992

LAST UPDATE DATE

2025-04-12T23:29:09.136000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2025-003179	date:	2025-04-10T09:21:00
db:	NVD	id:	CVE-2025-2992	date:	2025-04-07T14:40:55.240

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2025-003179	date:	2025-04-10T00:00:00
db:	NVD	id:	CVE-2025-2992	date:	2025-03-31T11:15:39.393