Fh1202 Firmware EUVD-2025-17834

This vulnerability presents exceptional real-world risk despite the requirement for authenticated access. CVSS 8.8 (High severity) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), and high impact across all three security dimensions (C:H/I:H/A:H). However, the PR:L (Low Privilege Required) requirement is significant—the attacker must authenticate first, reducing the attack surface compared to unauthenticated exploits. The CVSS:3.1 vector indicates a severity threshold that warrants immediate attention. Critical risk factors include: (1) Public exploit disclosure and POC availability dramatically increase exploitation probability and enable broad attack adoption; (2) Stack-based buffer overflows are reliably exploitable and often enable RCE; (3) The affected device is a consumer router with persistent network exposure; (4) Firmware updates for consumer devices are frequently delayed or never deployed. The authenticated requirement is a mitigating factor but does not eliminate risk, as default/weak credentials on routers are common. This should be treated as a critical priority for all Tenda FH1202 installations.

An authenticated attacker (who has obtained valid credentials through credential stuffing, default credentials, or weak password guessing) connects to the Tenda FH1202 router's web management interface. The attacker crafts an HTTP POST request to /goform/VirtualSer with a maliciously oversized 'page' parameter containing shell code or ROP gadget chains. The unsanitized parameter is copied into a fixed-size stack buffer without length validation, overflowing the buffer and overwriting adjacent stack memory including the return address. The attacker can control the return pointer to redirect execution to injected shellcode or existing code gadgets, achieving arbitrary code execution with root privileges. With public POC availability, an attacker can automate this exploit and systematically compromise multiple Tenda FH1202 devices, potentially establishing persistence through firmware modification or creating a botnet. The low attack complexity and network accessibility make this highly automatable at scale.