CVE-2025-2989

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/AdvSetWrl of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-298906.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains CVE-2025-298914.8Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3 CVE-2025-298928.8An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who h CVE-2025-298938.8An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-298948.8An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-298952.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-298962.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-298972.3A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user acco CVE-2025-298986.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the CVE-2025-298996.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains CVE-2025-29905.3A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the fi CVE-2025-299006.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains