Fh1202 Firmware CVE-2025-7530

This vulnerability presents HIGH real-world risk despite being gated by authentication requirements. Risk assessment synthesis: (1) CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), PR:L (low privilege requirement) indicates significant attack surface—any authenticated user can trigger it; (2) Public POC availability dramatically increases exploitation probability; (3) CWE-119 stack buffer overflows are highly reliable exploitation primitives with consistent code execution outcomes; (4) Tenda router firmware is commonly deployed in residential and small business environments with limited patch management; (5) The authentication requirement (PR:L) is not a strong barrier since PPTP configuration interfaces often have default or weak credentials, and local network attackers can easily obtain credentials. EPSS scoring would likely be CRITICAL (>0.97 probability) given POC availability and low complexity. This is NOT a low-risk high-CVSS issue—it represents genuine, easily exploitable compromise of router devices.

Realistic attack scenario: An attacker gains access to a Tenda FH1202 router's web management interface through compromised credentials (obtained via phishing, default credentials, or local network access). The attacker crafts a specially-formed HTTP request to /goform/PPTPDClient with an oversized Username parameter (e.g., 500+ bytes when stack buffer is ~64 bytes), overflowing the stack buffer. The overflow overwrites the function return address with attacker-controlled shellcode address. Upon function return, execution jumps to the shellcode, which executes with router firmware privileges, allowing complete router compromise: modification of firewall rules, DNS redirection, traffic interception, persistent backdoor installation, or lateral movement into the network. Given POC availability, an attacker with network access can automate this attack across multiple FH1202 devices. Attack complexity is low—no user interaction required beyond HTTP request submission, and the buffer overflow is reliable and deterministic.