CVE-2025-14994CWE-119CWE-121

CVE-2025-14994

High · published December 21, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

⚡ A remote attacker can exploit a stack-based buffer overflow in Tenda FH1201 and FH1206 firmware! This vulnerability is like a sneaky thief who finds an open window and slips right into your home. 🔥 Think of this vulnerability like a delivery truck that overfills its cargo. When it tries to drive away, everything spills over, causing chaos on the road. In this case, the overflow happens in the memory stack, allowing attackers to manipulate your device's behavior. An attacker could potentially gain control over the device, interfere with its functions, or even execute arbitrary code. This could lead to unauthorized access to sensitive data or disruption of service, causing some seriously frustrating headaches for users and administrators alike!

Put simply

Think of this vulnerability like a delivery truck that overfills its cargo. When it tries to drive away, everything spills over, causing chaos on the road. In this case, the overflow happens in the memory stack, allowing attackers to manipulate your device's behavior. This flaw in the HTTP Request Handler's strcat function allows attackers to send maliciously crafted requests that overflow the stack buffer based on the webSiteId argument, making remote exploitation possible.

What to do

An attacker could potentially gain control over the device, interfere with its functions, or even execute arbitrary code. This could lead to unauthorized access to sensitive data or disruption of service, causing some seriously frustrating headaches for users and administrators alike! To protect your network, immediately patch affected devices to version 1.2.0.15 for the FH1201 and 1.2.0.9 for the FH1206. Additionally, consider implementing network segmentation to limit exposure, and monitor for unusual activity while waiting for a fix. You've got this! By taking these steps, you'll fortify your defenses and keep the internet a safer place. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00746 · 54.3th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-12-21T13:15Z
Affected products (2)
ProductVersionsFixed in
tenda/fh1201_firmwareall versions—
tenda/fh1206_firmwareall versions—
References (7)
EPSS history
Timeline
  • 21 DEC 07:32Z
    Tenda FH1201/FH1206 HTTP Request webtypelibrary strcat stack-based overflow
    cvelistv5