Fh1205 Firmware EUVD-2025-18366

Despite the CVSS 3.1 score of 8.8 (High), multiple factors elevate real-world priority to Critical: (1) Attack Vector is Network with Low Complexity and Low Privileges Required (L), meaning authenticated access is the only gate—many routers have default credentials or suffer from other auth bypasses; (2) KEV/public exploit disclosure indicates active weaponization potential; (3) Proof-of-concept availability substantially increases EPSS exploitation probability; (4) All CIA triad impacts are High (Complete confidentiality, integrity, availability breach); (5) SSVC analysis: Exploitation is Public, impact is Total System Compromise, and this is highly automatable across identical firmware versions. The requirement for prior authentication (PR:L) is the primary limiting factor, but credential compromise or auth bypass vulnerabilities in companion services could eliminate this. This represents a genuine critical threat to Tenda FH1205 deployments, particularly in IoT/small business environments with weak credential hygiene.

An attacker with valid router credentials (obtained via phishing, credential stuffing, or default credentials) sends a crafted HTTP POST request to http://[router-ip]/goform/VirtualSer with an oversized 'page' parameter containing shellcode payload. The fromVirtualSer function copies this unsanitized input into a fixed stack buffer, overflowing it and corrupting the stack frame. By carefully crafting the overflow, the attacker overwrites the function return address with a pointer to their shellcode, achieving arbitrary code execution with root privileges when the corrupted function returns. The attacker can then install persistent backdoors, exfiltrate network traffic, pivot to internal networks, or brick the device. Automation is trivial given public POC availability—an attacker could script mass exploitation of identifiable FH1205 devices via Shodan or similar scanning. The low CVSS complexity (AC:L) reflects that no race conditions, user interaction, or special configurations are required beyond initial authentication.