Fh1202 Firmware CVE-2025-7532

CVSS 8.8 reflects high severity with network-accessible attack vector (AV:N), low complexity (AC:L), but requires low privilege level (PR:L) and user interaction (UI:N), indicating an authenticated attacker can remotely trigger the overflow. The CVSS vector signals: (1) Network exploitability without special conditions, (2) No authentication bypass needed once initial access obtained, (3) Complete system compromise possible. The public POC disclosure significantly elevates real-world risk—this transitions from theoretical to immediately weaponizable. The authentication requirement (PR:L) slightly reduces attack surface compared to unauthenticated RCE but does not meaningfully lower risk given: router admin credentials are often default/weak, credential compromise via phishing, or pre-authentication bypass vulnerabilities in the same device. Without explicit EPSS or KEV confirmation data provided, the combination of (critical CVSS 8.8 + public POC + embedded device + authentication-adjacent access) suggests EPSS probability ≥0.80 and strong likelihood of KEV inclusion. This is a HIGH PRIORITY vulnerability—embedded devices are difficult to patch and remain in production for years; widespread deployment amplifies impact.

An attacker with low-privilege access to a Tenda FH1202 router (e.g., guest WiFi account, phished admin credentials, or successful credential stuffing due to default passwords) sends a crafted HTTP POST request to /goform/webExcptypemanFilter with an excessively long value in the 'page' parameter. The vulnerable function copies this input into a fixed-size stack buffer without bounds checking, overflowing adjacent stack memory. The attacker carefully constructs the overflow payload to overwrite the return address with shellcode or ROP chain, achieving arbitrary code execution with router privileges. This allows the attacker to: (1) Steal WiFi credentials and connected device data, (2) Perform man-in-the-middle attacks on all traffic through the router, (3) Deploy persistent backdoors for botnet recruitment, (4) Pivot to other network-connected devices (printers, IoT, corporate systems if connected). Public POC existence means script-kiddies can exploit this without deep vulnerability research; mass scanning and exploitation via Shodan-identified FH1202 devices is credible within days of POC release.