CVE-2025-14994
Published: 21 December 2025
Summary
CVE-2025-14994 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Fh1201 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of the webSiteId input argument to prevent stack-based buffer overflows from improper strcat usage in the HTTP request handler.
SI-16 enforces memory protections like stack canaries, ASLR, and DEP to mitigate exploitation of the stack-based buffer overflow vulnerability.
SI-2 mandates timely flaw remediation through firmware patching to address the specific buffer overflow in Tenda FH1201/FH1206 routers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote stack-based buffer overflow in router HTTP handler (/goform/webtypelibrary) enables exploitation of public-facing web applications and remote services for potential RCE.
NVD Description
A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the component HTTP Request Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack is possible…
more
to be carried out remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2025-14994 is a stack-based buffer overflow vulnerability in the strcat function within the /goform/webtypelibrary endpoint of the HTTP Request Handler component. It affects Tenda FH1201 and FH1206 routers running firmware versions 1.2.0.14(408) and 1.2.0.8(8155). The issue stems from improper manipulation of the webSiteId argument, as documented with associated CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), such as an authenticated user on the network. Exploitation involves sending a crafted HTTP request to the vulnerable endpoint, triggering the buffer overflow. Successful exploitation grants high-impact confidentiality, integrity, and availability consequences, potentially allowing arbitrary code execution, data theft, or denial of service on the affected router.
References include proof-of-concept exploits published on GitHub for both Tenda FH1201 and FH1206 models, detailing the buffer overflow in the webtypelibrary function. VulDB entries document the issue but do not specify patches or vendor mitigations in the provided information. The public availability of exploits increases the risk of real-world attacks.
Details
- CWE(s)