Tenda CVE-2026-5045

Requires authenticated access to Tenda FH1201 firmware version 1.2.0.14(408). Attacker must send crafted POST request to /goform/WrlclientSet endpoint with malicious GO parameter to trigger stack-based buffer overflow in WrlclientSet function.

Real-world risk is HIGH despite requiring authentication. The CVSS 8.8 score reflects network-based attack vector (AV:N), low complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). Critically, authentication requirement is low-privilege (PR:L), meaning default or weak router credentials often satisfy this barrier. Public exploit code exists on GitHub (E:P confirmed), significantly lowering the skill threshold for exploitation. While not listed in CISA KEV (no confirmed active exploitation campaigns), the combination of publicly available POC, widespread deployment of consumer routers, and common credential weaknesses elevates practical risk. SSVC factors indicate moderate-to-high priority: exploitation is demonstrated (POC public), technical impact is total system compromise, and while not fully automatable (requires auth), credential stuffing or default password attacks enable broad targeting. The lack of vendor patch (RL:X) means vulnerable devices remain exposed indefinitely unless replaced or isolated. This is a legitimate high-priority issue, not inflated CVSS.

An attacker conducts reconnaissance identifying Tenda FH1201 routers exposed via default credentials or harvested through credential stuffing attacks against the web management interface. After authenticating with low-privilege credentials (often 'admin:admin' on consumer routers), the attacker crafts a malicious HTTP request to /goform/WrlclientSet with an oversized 'GO' parameter payload containing shellcode. The stack-based overflow overwrites the return address, redirecting execution to attacker-controlled code running with router system privileges. The attacker establishes persistent backdoor access, pivots to internal network resources, intercepts traffic, or enlists the router in a botnet. Low attack complexity (AC:L) and network-based vector (AV:N) enable mass exploitation campaigns against internet-facing devices.