Tenda FH1202 CVE-2026-7035

Requires authenticated access to the Tenda FH1202 web management interface - attacker must possess valid administrative credentials (username/password). The router's HTTP/HTTPS management interface must be network-accessible to the attacker, whether exposed to the internet via remote administration features or accessible from a compromised internal network position. The vulnerability exists in the default configuration of firmware 1.2.0.14 with no special features requiring enablement. Attack complexity is low (AC:L) with no additional timing or race condition requirements (AT:N). Exploitation is NOT limited by user interaction (UI:N) beyond the initial authentication step. Key limiting factor is the low-privilege authentication requirement (PR:L), meaning the attack is not remotely executable against default configurations without first obtaining credentials through brute force, credential stuffing, social engineering, or exploiting a separate authentication bypass vulnerability. The vulnerability does not require specific wireless configurations or client connections - it affects the wired/wireless management interface itself.

Real-world risk is moderate-to-high despite requiring authentication. CVSS 4.0 score of 7.4 reflects network-based attack vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), and high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The authentication requirement (PR:L) provides some friction, but consumer routers often use weak default credentials or credentials discoverable through other vulnerabilities, reducing this barrier in practice. The publicly available POC exploit from Litengzheng on GitHub significantly lowers the skill threshold for exploitation. The attack is automatable once credentials are obtained (AC:L/AT:N), making it suitable for mass scanning campaigns targeting exposed router management interfaces. However, no CISA KEV listing suggests exploitation is not yet widespread in the wild, and EPSS data is unavailable for comparison. The vulnerability's scope is unchanged (SC:N), limiting lateral movement potential. Primary risk is to organizations exposing router admin interfaces to untrusted networks or using weak authentication. Missing data: EPSS probability score, vendor acknowledgment, and confirmation of whether firmware 1.2.0.14 is current or end-of-life.

An attacker scans internet-facing IP ranges for Tenda FH1202 routers with exposed web management interfaces on port 80 or 443. Using credential stuffing attacks with common default passwords (admin/admin) or credentials leaked from other breaches, the attacker authenticates to the router's web interface. They craft an HTTP POST request to /goform/WrlclientSet containing an oversized 'Go' parameter value designed to overflow the stack buffer in fromWrlclientSet. The overflow overwrites the function's return address with the location of attacker-supplied shellcode embedded in the request, achieving arbitrary code execution with root privileges. The attacker establishes persistence by modifying router configuration to beacon to a command-and-control server, then pivots to internal network reconnaissance or deploys the router as a proxy node in a botnet. The public POC code (https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_20/README.md) provides ready-made exploit tooling, lowering technical barriers significantly.