Fh1205 Firmware CVE-2025-6112

CVSS 8.8 (High/Critical) reflects: AV:N (network-accessible), AC:L (low complexity), PR:L (requires authentication), UI:N (no user interaction), S:U (scope unchanged), C:H/I:H/A:H (complete compromise). The authentication requirement (PR:L) is a mitigating factor but does not significantly reduce risk in residential/SMB environments where default credentials are common or users have access. Real-world risk is elevated by: (1) Public POC availability enabling weaponization, (2) Tenda FH1205's presence in consumer and small-business networks, (3) CVSS vector indicating full system takeover capability, (4) No patch timeline evident from description. EPSS would likely assess this as high-probability exploitation. The KEV status (if listed) would indicate active exploitation in the wild. Compared to unauthenticated RCEs, this is slightly less critical due to authentication requirement, but functionally equivalent once an attacker gains initial access (via weak credentials, phishing, or local network access). Priority: Critical for affected organizations.

An attacker with knowledge of weak/default router credentials (common in residential settings) logs into the FH1205 web admin interface and crafts an HTTP POST request to /goform/AdvSetLanip with a malicious 'lanMask' parameter containing shellcode or ROP chain. The buffer overflow overwrites a return address or function pointer on the stack/heap. Upon function return or virtual method call, control flow redirects to attacker-controlled code. The attacker achieves unauthenticated remote code execution on the router, allowing them to: install backdoors, intercept traffic, pivot to internal network, steal DNS/DHCP data, or launch botnet attacks. Public POC likely includes curl commands or Python scripts automating this process. Attack complexity is low—no heap spraying or ASLR bypass required if mitigations are weak in firmware. Realistic scenario: compromised internal user or attacker on the same WiFi network exploits this to gain router root access.