Fh1201 Firmware CVE-2025-7551

This vulnerability presents exceptionally high real-world risk due to convergence of multiple critical factors: (1) CVSS 8.8 score reflects authenticated remote code execution with high impact across confidentiality, integrity, and availability; (2) Attack vector is NETWORK with LOW complexity, meaning exploitation is straightforward once authenticated; (3) The requirement for PR:L (Low Privilege) suggests any authenticated user can exploit it, and in default router configurations, this may include unauthenticated remote access depending on network exposure; (4) Public POC availability dramatically increases exploitation likelihood; (5) CWE-119 stack buffer overflows are highly reliable for achieving RCE on embedded systems like routers with minimal ASLR/DEP protections; (6) Tenda routers are widely deployed in consumer/SMB environments with poor patch management. EPSS score would likely be elevated (>0.80+) given public POC and exploitability. Estimated SSVC decision: IMMEDIATE action required due to Exploitation:Active or PoC:Public status, network-accessible impact, and likely automatable exploitation.

A local network attacker or remote attacker with valid router credentials (e.g., through credential compromise, weak defaults, or brute force) authenticates to the Tenda FH1201 web management interface. The attacker crafts an HTTP POST request to /goform/PPTPDClient with an oversized modino or username parameter containing shellcode payload (typically 100+ bytes to overflow the stack buffer). The vulnerable fromPptpUserAdd function copies the attacker-supplied string without length validation, overwriting the stack return address with a pointer to the shellcode. When the function returns, execution jumps to the attacker's code, granting root-level code execution on the router. From this position, the attacker can pivot to internal networks, exfiltrate data, modify firewall rules, establish persistence, or use the router as a botnet node. Given public POC availability, this exploitation is highly likely to be automated in scan-and-exploit campaigns targeting Tenda devices.