CVE-2025-14995CWE-119CWE-121

CVE-2025-14995

High · published December 21, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

🚨 A remote attacker can trigger a stack-based buffer overflow in Tenda FH1201 with just a crafty parameter manipulation! ⚡ Think of it like a restaurant that mistakenly accepts an oversized order request without checking its limits — if the kitchen gets overwhelmed, things could spill over and create a huge mess! This vulnerability could allow an attacker to execute arbitrary code on the device, potentially taking full control of it. Imagine a scenario where they gain access to your network, snooping on sensitive data or even rerouting your internet traffic! This could lead to serious consequences if exploited!

Put simply

Think of it like a restaurant that mistakenly accepts an oversized order request without checking its limits — if the kitchen gets overwhelmed, things could spill over and create a huge mess! CVE-2025-14995 affects the sprintf function in the /goform/SetIpBind file, allowing attackers to send specially crafted arguments that exploit a stack-based buffer overflow, compromising the device's stability and security.

What to do

This vulnerability could allow an attacker to execute arbitrary code on the device, potentially taking full control of it. Imagine a scenario where they gain access to your network, snooping on sensitive data or even rerouting your internet traffic! This could lead to serious consequences if exploited! To protect yourself, update the Tenda FH1201 firmware to the latest version as soon as possible. Additionally, consider implementing network segmentation to limit the exposure of vulnerable devices. Regularly check for updates to stay secure! You've got this! By taking these steps, you can fortify your defenses and keep your network secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-12-21T14:15Z
Affected products (1)
ProductVersionsFixed in
tenda/fh1201_firmwareall versions—
References (6)
EPSS history
Timeline
  • 21 DEC 08:32Z
    Tenda FH1201 SetIpBind sprintf stack-based overflow
    cvelistv5