CVE-2025-7528
published 2025-07-13CVE-2025-7528: A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file…
PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.76%
50.9th percentile
A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | sqlite3 | >= 0 < 3.8.2-1ubuntu2.2+esm5 | 3.8.2-1ubuntu2.2+esm5 |
| ghost | sqlite3 | >= 0 < 3.11.0-1ubuntu1.5+esm3 | 3.11.0-1ubuntu1.5+esm3 |
| ghost | sqlite3 | >= 0 < 3.22.0-1ubuntu0.7+esm2 | 3.22.0-1ubuntu0.7+esm2 |
| ghost | sqlite3 | >= 0 < 3.31.1-4ubuntu0.7+esm1 | 3.31.1-4ubuntu0.7+esm1 |
| tenda | fh1202 | — | — |
| tenda | fh1202_firmware | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
sqlite3 vulnerabilities
osv·2025-07-29·CVSS 5.5
CVE-2025-6965 sqlite3 vulnerabilities
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled aggregate terms. An
attacker could use this issue to cause SQLite to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2025-6965)
It was discovered that SQLite incorrectly handled certain argument values
to sqlite3_db_config(). An attacker could use this issue to cause SQLite to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This update fixes the issue in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. This issue was previously fixed in Ubuntu 20.04 LTS via
USN-7528-1. (CVE-2025-29088)
GHSA
GHSA-p8qm-qqr7-wgrp: A vulnerability classified as critical has been found in Tenda FH1202 1
ghsa_unreviewed·2025-07-13
CVE-2025-7528 [HIGH] CWE-119 GHSA-p8qm-qqr7-wgrp: A vulnerability classified as critical has been found in Tenda FH1202 1
A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-13
Published