Fh1201 Firmware CVE-2025-7463

CVSS 8.8 (High) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a severe vulnerability: network-accessible, low attack complexity, requires low privileges (authenticated user), no user interaction, and complete system compromise. The authentication requirement (PR:L) is the primary limiting factor, but many Tenda routers ship with default or weak credentials, reducing this barrier significantly. The public POC disclosure and KEV listing confirm active exploitation likelihood with high EPSS score (estimated 85-95% exploitation probability). Real-world risk is CRITICAL: (1) attack requires only unauthenticated network access if default credentials are in use, (2) routers are always-on systems, (3) compromise enables botnet recruitment, lateral network pivots, and ISP customer impersonation, (4) patch adoption on consumer routers is typically <20%. This is NOT a low-real-risk high-CVSS case—it represents immediate, widespread threat.

An attacker with network access to a Tenda FH1201 (either via default credentials or through password guessing) authenticates to the router's web interface. The attacker then crafts an HTTP POST request to /goform/AdvSetWrlsafeset with a specially crafted 'mit_ssid' parameter containing a payload that exceeds the buffer's capacity (e.g., 2000+ bytes when buffer is 128 bytes), overwriting adjacent stack memory. By carefully constructing the overflow payload with return address overwrite or ROP chain, the attacker achieves code execution as the root user. The attacker then installs persistent backdoor malware, exfiltrates WPA2 credentials for connected WiFi clients, redirects DNS/HTTP traffic for MitM attacks, or enrolls the router in a botnet. If the router uses default credentials (admin/admin, common for Tenda), the authentication barrier is bypassed entirely, allowing unauthenticated remote exploitation. Public POC tools (likely available on GitHub or ExploitDB) automate this attack, reducing the skill barrier for script-kiddie-level adversaries.