CVE-2025-2993

medium · 6.9

A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

6.9

CVSS

10.9%

EPSS (exploit prob.)

96th

EPSS percentile

2025-03-31

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-266CWE-284

Affected products

Vendor	Product	Affected versions
tenda	fh1202_firmware	1.2.0.14(408)
tenda	fh1202	all versions

Check a specific version with /api/v1/cve/match.

References

https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-default-cfg-1bc53a41781f806d8016cd4e73ca4d6f?pvs=4
https://vuldb.com/?ctiid.302042
https://vuldb.com/?id.302042
https://vuldb.com/?submit.523416
https://www.tenda.com.cn/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-2993