Fh1202 Firmware CVE-2025-7527

This vulnerability presents HIGH real-world risk despite requiring authenticated access (PR:L). Risk factors include: (1) CVSS 8.8 reflects high severity with network-accessible attack vector and complete system compromise potential; (2) Public exploit availability significantly increases exploitation probability; (3) Authentication requirement (PR:L) is moderate friction but many routers have weak default credentials or credential reuse; (4) Stack-based buffer overflows in embedded firmware are reliably exploitable with minimal complexity (AC:L); (5) Lack of modern mitigations (ASLR, DEP) in typical router firmware increases success rate. EPSS score would likely be CRITICAL if available. SSVC scoring would rate this as IMMEDIATE/SCHEDULED due to: exploitation=public, automatable=yes (can be chained with weak auth), technical_impact=total. Priority should be CRITICAL for organizations operating Tenda FH1202 devices.

An attacker with network access to a Tenda FH1202 router (internal network or compromised account) can craft a malicious HTTP POST request to /goform/AdvSetWan containing a shellcode payload embedded within an oversized PPPOEPassword parameter (exceeding the stack buffer size, typically 16-256 bytes depending on implementation). The overflow overwrites the return address on the stack, redirecting execution to the attacker's shellcode. The attacker gains root/admin privileges on the router, enabling: (1) credential harvesting from connected devices, (2) traffic interception/MITM attacks, (3) lateral network movement, (4) persistent backdoor installation, (5) router botnet recruitment. Public POC code likely includes a Python or C-based script that generates the malicious payload and sends it to a target router's IP:80/goform/AdvSetWan. No user interaction required (UI:N). Attack success is high given AC:L and typical lack of exploitation protections in router firmware.