Fh1201 Firmware CVE-2025-7465

CVSS 8.8 (High/Critical) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates high exploitability and severe impact. The attack vector is NETWORK (AV:N) with LOW complexity (AC:L), requiring only LOW privileges (PR:L—an authenticated user) with NO user interaction (UI:N), affecting the UNCHANGED scope (S:U). The high impact ratings (C:H/I:H/A:H) reflect complete system compromise. CRITICAL SIGNALS: (1) Public POC exists—exploitation is trivial for threat actors; (2) Authenticated but low-privilege requirement—many firmware deployments have weak default credentials or authentication bypass chains; (3) Network-accessible endpoint—no additional network traversal required. REAL-WORLD PRIORITY: CRITICAL. While PR:L technically lowers CVSS slightly below 9.0, the combination of public POC, network accessibility, simple exploitation (low AC:L), buffer overflow leading to RCE, and targeting consumer IoT/router devices makes this immediately actionable by mass-exploitation campaigns. This is not a 'high-CVSS-low-risk' case—it is genuinely high-risk.

An attacker with low-privilege access to the router's management interface (e.g., via compromised WiFi credentials, default credentials, or a chained vulnerability) sends a crafted HTTP POST request to /goform/fromRouteStatic with an oversized 'page' parameter containing shellcode. The unvalidated input overflows a stack or heap buffer in the firmware, overwriting function return addresses or heap metadata. The attacker achieves arbitrary code execution in the router's kernel context, gaining full control: modifying firewall rules, intercepting network traffic, installing persistent backdoors, or using the router as a botnet node. Given the public POC availability, attackers can automate this exploitation at scale against exposed or poorly secured Tenda FH1201 devices on corporate networks, ISP networks, or consumer networks.