CVE-2025-7747

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7747
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. The manipulation of the argument PPW leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS

No CVSS.

References
Link Resource
https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md Exploit Third Party Advisory
https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md Exploit Third Party Advisory
https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md#payload Exploit Third Party Advisory
https://vuldb.com/?ctiid.316737 Permissions Required VDB Entry
https://vuldb.com/?id.316737 Third Party Advisory VDB Entry
https://vuldb.com/?submit.615487 Third Party Advisory VDB Entry
https://www.tenda.com.cn/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:fh451_firmware:1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:h:tenda:fh451:-:*:*:*:*:*:*:*
History

18 Jul 2025, 17:11

Type Values Removed Values Added
CWE CWE-120
References () https://www.tenda.com.cn/ - () https://www.tenda.com.cn/ - Product
References () https://vuldb.com/?ctiid.316737 - () https://vuldb.com/?ctiid.316737 - Permissions Required, VDB Entry
References () https://vuldb.com/?submit.615487 - () https://vuldb.com/?submit.615487 - Third Party Advisory, VDB Entry
References () https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md#payload - () https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md#payload - Exploit, Third Party Advisory
References () https://vuldb.com/?id.316737 - () https://vuldb.com/?id.316737 - Third Party Advisory, VDB Entry
References () https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md - () https://github.com/zezhifu1/cve_report/blob/main/FH451/fromWizardHandle.md - Exploit, Third Party Advisory
CPE cpe:2.3:h:tenda:fh451:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:fh451_firmware:1.0.0.9:*:*:*:*:*:*:*
First Time Tenda fh451 Firmware
Tenda fh451
Tenda

17 Jul 2025, 20:15

Type Values Removed Values Added
CWE CWE-120
CWE-119
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown

17 Jul 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-17 18:15

Updated : 2025-07-18 17:11

NVD link : CVE-2025-7747

Mitre link : CVE-2025-7747

JSON object : View

Products Affected

tenda

  • fh451_firmware
  • fh451
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')