CVE-2025-2993

This issue is like leaving a “backstage instructions” file open on the front of your store without a lock. Someone who can reach your router over the network may be able to download sensitive configuration details from the default file (/default.cfg) without needing a username and password. That information can then help them plan the next step against your network.

This matters if you run or manage a Tenda FH1202 router (including fh1202 firmware) in your business network. It’s specifically a risk when the vulnerable file is reachable from the network, and the findings note it can be attacked remotely without authentication. If your router is not exposed to the internet and external access is blocked, the risk is much lower.

This is an AMBER issue because a public exploit is available and the ability to reach the default configuration file from the network can be used without authentication. Attackers don’t need to log in first, which makes opportunistic scanning more likely. Press attention is also rising, but the key driver here is the available exploit and remote exposure.

1. Identify exposure
   • Determine how your router is reachable from outside your network.
   • Check for port forwarding / inbound NAT rules in your firewall/router setup.
   • Verify whether the router’s web management (or related services) is reachable from the internet.
2. Check if you’re running the affected firmware
   • Log into the Tenda FH1202 admin interface.
   • Note the firmware version.
   • Pay special attention if it matches the affected line referenced in the report (including Tenda FH1202 1.2.0.14(408)).
3. Apply the fix
   • Upgrade to the vendor’s fixed firmware version for Tenda FH1202 when released.
   • If you use a managed ISP device profile or vendor customization, coordinate with the provider for the fixed firmware package.
4. Compensating controls (if patching is delayed)
   • Use network firewall rules to block inbound connections to the router from the internet.
   • Remove unnecessary port forwarding so that external users cannot reach /default.cfg (and other internal services).
   • Allow only internal admin access from trusted local IP ranges, not from the public internet.
5. Verify remediation
   • After upgrading and/or changing firewall rules, confirm that external requests to the default configuration endpoint are no longer reachable.
   • Review router/firewall logs for attempted inbound connections to the router from outside your network.
6. What to monitor
   • Inbound connection attempts to the router from the internet.
   • Repeated web requests that look like automated probing for configuration files.

Note on KEV: this CVE is not listed in CISA KEV based on the provided findings.

Severity is reported as medium (CVSS 5.3). The weakness is improper access control (CWE-266) and improper access control mechanics (CWE-284) leading to unauthorized access to sensitive information. The attack targets /default.cfg, which is reachable in the default configuration, over the network, without authentication and without user interaction. A public exploit is available, and the traffic-light verdict for this issue is AMBER. KEV is not listed, and EPSS is provided as a prediction (not a proof of active exploitation). Press attention is rising, but the decisive factors here are remote reachability and the existence of a public exploit.