Fh1201 Firmware CVE-2025-7548

This vulnerability presents HIGH real-world risk across multiple threat intelligence signals: (1) CVSS 8.8 with attack vector Network/Low complexity/Low privileges required indicates broad exploitability; (2) Public exploit disclosure means threat actors have functional attack code; (3) Stack overflow enables arbitrary code execution, allowing complete device compromise and potential lateral network movement; (4) Affected devices are consumer routers with weak patching hygiene—many users never update firmware; (5) The low privilege requirement (authenticated but potentially achievable via default credentials common on Tenda devices) reduces attacker barriers. However, exploitation requires network access to the management interface, which may be restricted by network segmentation in enterprise environments. This is NOT a low-priority issue despite the privilege requirement—consumer and SMB environments face severe risk. EPSS would likely score >0.85 given public POC availability and ease of exploitation.

An attacker on the same network or with access to the router's WAN-exposed management interface (common misconfiguration) connects to http://[router-ip]:80/goform/SafeEmailFilter and sends a POST request with a malicious 'page' parameter containing a buffer overflow payload (e.g., oversized input to trigger stack buffer overflow). The overflow corrupts the stack frame and overwrites the return pointer with shellcode address. Upon function return, arbitrary code executes with root/admin privileges, allowing the attacker to: install persistent backdoors, extract WAN credentials, redirect traffic for MITM attacks, or pivot to internal network resources. If default credentials (often admin/admin on Tenda devices) are unchanged, authentication is trivial. Given public POC exists, script-kiddie-level attackers can execute this attack; organized threat actors would rapidly deploy this against internet-facing Tenda routers for botnet recruitment or corporate network infiltration.