Fh451 Firmware EUVD-2025-21237

This vulnerability presents CRITICAL real-world risk despite authentication requirement. CVSS 8.8 with Network attack vector and Low complexity indicates ease of exploitation once authenticated. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms high confidentiality, integrity, and availability impact. Critically, public POC availability and disclosed exploit status elevate exploitation probability significantly; this is NOT a theoretical high-CVSS issue but an actively weaponizable threat. Authentication requirement (PR:L) is minimal barrier given common router credential weaknesses (default credentials, password reuse). Stack overflow nature allows arbitrary code execution, making this a complete system compromise vector. For SSVC framework: exploitation is ACTIVE (POC public), automatable (no user interaction required), and technical impact is TOTAL (complete router takeover). Organizations managing Tenda FH451 devices should prioritize this as high-urgency.

An attacker with network access to the Tenda FH451 device (either on the same LAN or via exposed WAN management interface if enabled) first authenticates using default credentials (Tenda FH451 common defaults: admin/admin) or leaked credentials. The attacker then crafts a malicious HTTP POST request to /goform/Natlimit with an oversized 'page' parameter containing shellcode or ROP gadgets. The stack buffer overflow in fromNatlimit() overwrites the return address, redirecting execution to attacker-controlled code. This achieves remote code execution with router privileges, allowing complete device compromise: exfiltration of network traffic, injection of malware into client connections, pivot to internal network, or denial of service. Public POC tools make this attack executable by non-sophisticated adversaries. Attack flow requires no user interaction or social engineering—only network-level access and valid credentials.