Fh1201 Firmware CVE-2025-7549

This vulnerability presents HIGH real-world risk despite the authentication requirement. CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), and PR:L (low privilege - authenticated user) indicates a practical attack surface. The authentication barrier is mitigated by: (1) default credentials being common in consumer routers, (2) credential disclosure in related router firmware often affecting multiple products, (3) many users never changing default passwords. EPSS would likely be elevated given public exploit disclosure and the automatable nature of stack-based buffer overflows. KEV status (known exploited vulnerability) confirms active exploitation in the wild. The attack requires no special user interaction (UI:N). Technical impact is complete system compromise (C:H/I:H/A:H). SSVC assessment: exploitation=active, automatable=yes, technical_impact=total. This is NOT a low-real-risk-high-CVSS issue—it merits immediate patching despite authentication requirement.

An attacker with valid credentials (obtained via default credentials, credential stuffing, or phishing) authenticates to the Tenda FH1201 web management interface. The attacker sends a crafted HTTP POST request to /goform/L7Prot with an oversized 'page' parameter containing shellcode. The parameter value overflows the stack buffer in frmL7ProtForm, overwriting the return address with a pointer to the attacker's shellcode. Upon function return, code execution occurs in the router's memory space with the privileges of the web service process (typically root in embedded Linux). The attacker achieves remote code execution, gaining complete control over the router including network traffic interception, DNS spoofing, firmware modification, and lateral network attacks. A public proof-of-concept likely demonstrates this flow with a specific payload size and offset. The attack is automatable and does not require user interaction on the victim's device.