CVE-2025-7806
Published: 18 July 2025
Summary
CVE-2025-7806 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Fh451 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of the Go/page argument in the fromSafeClientFilter function to prevent stack-based buffer overflow exploitation.
Provides memory protections such as stack canaries, ASLR, and DEP to mitigate stack-based buffer overflow attempts leading to arbitrary code execution.
Requires timely remediation of the identified buffer overflow flaw in Tenda FH451 firmware version 1.0.0.9 via patching or updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the web management interface (/goform/SafeClientFilter) of the Tenda FH451 router enables remote exploitation of a public-facing application.
NVD Description
A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit…
more
has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-7806 is a critical stack-based buffer overflow vulnerability in Tenda FH451 firmware version 1.0.0.9. It affects the fromSafeClientFilter function within the /goform/SafeClientFilter file, triggered by manipulation of the Go/page argument. Published on 2025-07-18, the flaw is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.
VulDB advisories (ctiid.316882, id.316882, submit.616348) document the issue, while GitHub repositories from panda666-888 provide public proof-of-concept exploits in fromSafeClientFilter_Go.md and fromSafeClientFilter_page.md, confirming remote stack overflow via the vulnerable argument. No vendor patches or specific mitigations are detailed in the available references.
The exploit has been disclosed publicly and may be used in the wild.
Details
- CWE(s)