Details of VAR-202503-2834

ID

VAR-202503-2834

CVE

CVE-2025-2996

TITLE

Shenzhen Tenda Technology Co.,Ltd. of FH1202 Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2025-003100

DESCRIPTION

A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /goform/SysToolDDNS of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of FH1202 There are unspecified vulnerabilities in the firmware.Information may be tampered with

Trust: 1.62

sources: NVD: CVE-2025-2996 // JVNDB: JVNDB-2025-003100

AFFECTED PRODUCTS

vendor:	tenda	model:	fh1202	scope:	eq	version:	1.2.0.14\(408\)	Trust: 1.0
vendor:	tenda	model:	fh1202	scope:	eq	version:	fh1202 firmware 1.2.0.14(408)	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2025-003100 // NVD: CVE-2025-2996

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-2996
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2025-2996
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-003100
value:	MEDIUM
Trust: 0.8

cna@vuldb.com:	CVE-2025-2996
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-003100
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2025-2996
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 2.0
NVD:	JVNDB-2025-003100
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2025-003100 // NVD: CVE-2025-2996 // NVD: CVE-2025-2996

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-284	Trust: 1.0
problemtype:	CWE-266	Trust: 1.0
problemtype:	Improper permission settings (CWE-266) [ others ]	Trust: 0.8
problemtype:	Inappropriate access control (CWE-284) [ others ]	Trust: 0.8
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-003100 // NVD: CVE-2025-2996

EXTERNAL IDS

db:	NVD	id:	CVE-2025-2996	Trust: 2.6
db:	VULDB	id:	302045	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-003100	Trust: 0.8

sources: JVNDB: JVNDB-2025-003100 // NVD: CVE-2025-2996

REFERENCES

url:	https://lavender-bicycle-a5a.notion.site/tenda-fh1202-systoolddns-1bc53a41781f8012a03be8bebed1125b?pvs=4	Trust: 1.8
url:	https://vuldb.com/?id.302045	Trust: 1.8
url:	https://vuldb.com/?submit.523419	Trust: 1.8
url:	https://www.tenda.com.cn/	Trust: 1.8
url:	https://vuldb.com/?ctiid.302045	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2025-2996	Trust: 0.8

sources: JVNDB: JVNDB-2025-003100 // NVD: CVE-2025-2996

SOURCES

db:	JVNDB	id:	JVNDB-2025-003100
db:	NVD	id:	CVE-2025-2996

LAST UPDATE DATE

2025-04-11T19:31:40.445000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2025-003100	date:	2025-04-09T06:54:00
db:	NVD	id:	CVE-2025-2996	date:	2025-04-08T13:04:38.877

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2025-003100	date:	2025-04-09T00:00:00
db:	NVD	id:	CVE-2025-2996	date:	2025-03-31T13:15:45.503