Sign-up

ID

VAR-202507-0523


CVE

CVE-2025-7505


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  fh451  Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-009170

DESCRIPTION

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of fh451 The firmware contains a buffer error vulnerability and a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the failure of the parameter page of the function frmL7ProtForm in the file /goform/L7Prot to correctly verify the length of the input data. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

Trust: 2.16

sources: NVD: CVE-2025-7505 // JVNDB: JVNDB-2025-009170 // CNVD: CNVD-2025-16965

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-16965

AFFECTED PRODUCTS

vendor:tendamodel:fh451scope:eqversion:1.0.0.9

Trust: 1.6

vendor:tendamodel:fh451scope:eqversion:fh451 firmware 1.0.0.9

Trust: 0.8

vendor:tendamodel:fh451scope: - version: -

Trust: 0.8

vendor:tendamodel:fh451scope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2025-16965 // JVNDB: JVNDB-2025-009170 // NVD: CVE-2025-7505

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-7505
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-009170
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-16965
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-7505
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-009170
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-16965
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-7505
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-009170
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-16965 // JVNDB: JVNDB-2025-009170 // NVD: CVE-2025-7505

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-009170 // NVD: CVE-2025-7505

EXTERNAL IDS

db:NVDid:CVE-2025-7505

Trust: 3.2

db:VULDBid:316188

Trust: 1.8

db:JVNDBid:JVNDB-2025-009170

Trust: 0.8

db:CNVDid:CNVD-2025-16965

Trust: 0.6

sources: CNVD: CNVD-2025-16965 // JVNDB: JVNDB-2025-009170 // NVD: CVE-2025-7505

REFERENCES

url:https://github.com/zezhifu1/cve_report/blob/main/fh451/frml7protform.md

Trust: 1.8

url:https://github.com/zezhifu1/cve_report/blob/main/fh451/frml7protform.md#payload

Trust: 1.8

url:https://vuldb.com/?id.316188

Trust: 1.8

url:https://vuldb.com/?submit.611504

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-7505

Trust: 1.4

url:https://vuldb.com/?ctiid.316188

Trust: 1.0

sources: CNVD: CNVD-2025-16965 // JVNDB: JVNDB-2025-009170 // NVD: CVE-2025-7505

SOURCES

db:CNVDid:CNVD-2025-16965
db:JVNDBid:JVNDB-2025-009170
db:NVDid:CVE-2025-7505

LAST UPDATE DATE

2025-07-29T23:26:18.168000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-16965date:2025-07-28T00:00:00
db:JVNDBid:JVNDB-2025-009170date:2025-07-17T08:40:00
db:NVDid:CVE-2025-7505date:2025-07-15T17:50:57.793

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-16965date:2025-07-25T00:00:00
db:JVNDBid:JVNDB-2025-009170date:2025-07-17T00:00:00
db:NVDid:CVE-2025-7505date:2025-07-12T23:15:21.480