Fh451 Firmware EUVD-2025-21101

This vulnerability presents extreme real-world risk despite the authentication requirement. CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation requiring only low privileges (authentication), low attack complexity, no user interaction, and complete system compromise. The authentication barrier is mitigated by: (1) default credentials commonly present in Tenda devices, (2) credential compromise via phishing/lateral movement, and (3) local network accessibility where routers are often deployed. The public disclosure of exploit code and confirmed exploitability elevates priority beyond theoretical risk. CVSS alone (8.8) may understate real impact given the embedded device context—router compromise enables network-wide attacks, man-in-the-middle capabilities, and persistence mechanisms. KEV inclusion (if confirmed) and demonstrated POC availability indicate operational exploitation likelihood is high. This should be treated as a critical priority for all Tenda FH451 deployments.

An attacker on the same network as a Tenda FH451 router obtains or guesses default credentials (e.g., admin/admin). The attacker crafts a malicious POST request to http://router-ip/goform/addressNat with an oversized 'page' parameter containing shellcode or a ROP chain. The vulnerable fromAddressNat function processes this input without bounds checking, overflowing the stack buffer and overwriting the return address with a pointer to injected shellcode. Upon function return, execution jumps to attacker-controlled code running with router privileges. The attacker achieves code execution, installs a persistent backdoor, redirects DNS traffic, performs packet sniffing on the network, or launches pivot attacks against connected devices. Exploitation requires minimal technical sophistication with publicly available POC code, making this a high-likelihood scenario in active threat environments.