Tenda FH1206 Firmware vulnerabilities

39 CVEs affecting Tenda FH1206 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-14994, published 2025-12-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-35339, published 2024-05-24. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac.
CVE-2024-4020, published 2024-04-20. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument…
CVE-2024-7615, published 2024-08-12. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability was found in Tenda FH1206 1.2.0.8. It has been declared as critical. Affected by this vulnerability is the function fromSafeClientFilter/fromSafeMacFilter/fromSafeUrlFilter. The…
CVE-2024-7614, published 2024-08-12. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability was found in Tenda FH1206 1.2.0.8(8155). It has been classified as critical. Affected is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument…
CVE-2024-7613, published 2024-08-12. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the…
CVE-2024-42987, published 2024-08-15. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be triggered via the modino, username, newpwd,…
CVE-2024-7707, published 2024-08-13. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Tenda FH1206 02.03.01.35 and classified as critical. Affected by this issue is the function formSafeEmailFilter of the file /goform/SafeEmailFilter of the component HTTP…
CVE-2024-42978, published 2024-08-15. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request.
CVE-2024-35340, published 2024-05-24. High severity, CVSS 8.6. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand.
CVE-2024-34943, published 2024-05-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting.

Latest

CVE-2025-14994, published 2025-12-21. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the component HTTP Request Handler. This…
CVE-2024-12002, published 2024-11-30. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability classified as problematic was found in Tenda FH451, FH1201, FH1202 and FH1206 up to 20241129. Affected by this vulnerability is the function websReadEvent of the file /goform/GetIPTV.…
CVE-2024-44390, published 2024-08-23. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset.
CVE-2024-44387, published 2024-08-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet.
CVE-2024-44386, published 2024-08-23. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind.
CVE-2024-42986, published 2024-08-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service…
CVE-2024-42985, published 2024-08-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a…
CVE-2024-42984, published 2024-08-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS)…
CVE-2024-42983, published 2024-08-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS)…