Fh1202 Firmware CVE-2025-7529

This vulnerability represents substantial real-world risk due to multiple compounding factors: (1) CVSS 8.8 reflects high severity with network accessibility (AV:N), low attack complexity (AC:L), and high impact (C:H/I:H/A:H), though it requires low privileges (PR:L), indicating an authenticated attacker; (2) Public exploit disclosure substantially increases exploitation probability—this is no longer theoretical; (3) Embedded device context means patching lag is severe; many deployed FH1202 units may never receive updates; (4) Buffer overflow in NAT functionality suggests exploit reliability (stack overflow with code execution is typically deterministic on embedded devices with fixed memory layouts). The PR:L requirement is notable but not reassuring: many Tenda routers use default credentials or have weak authentication. SSVC analysis: Exploitation is confirmed (PUBLIC), automatable (buffer overflow with PoC is typically easily weaponizable), and technical impact is total compromise. This is CRITICAL priority for organizations managing Tenda router fleets.

An attacker with valid router credentials (obtained via credential stuffing against default credentials, phishing, or prior compromise) sends a crafted HTTP POST request to http://<router_ip>/goform/Natlimit with a maliciously oversized 'page' parameter containing shellcode. The buffer overflow overwrites the stack, hijacking the function return pointer to execute arbitrary code. With code execution in the web server process (likely running as root on embedded Linux), the attacker achieves remote code execution, enabling installation of backdoors, botnet agents, or lateral movement into the internal network. If the router is Internet-accessible (no PR:L barrier due to weak auth), exploitation is trivial and likely automated. PoC is publicly disclosed, meaning attack tooling is readily available and exploitation is commodity-level.