Fh1202 Firmware EUVD-2025-21257

Despite the high CVSS 3.1 score of 8.8, multiple factors indicate substantial real-world exploitation risk: (1) CVSS vector AV:N (network-accessible) and AC:L (low complexity) enable remote exploitation with minimal attacker effort; (2) PR:L (low privilege required) means any authenticated user can trigger it—significant in SOHO deployments where default credentials or weak authentication is common; (3) Public exploit availability significantly increases real-world threat likelihood; (4) The vulnerability affects network infrastructure (router), making it a high-value target for botnet operators and nation-state actors seeking persistent access; (5) Consumer devices often lack timely patching, extending exposure window. EPSS probability would likely be elevated (>0.75) given public POC and authentication-bypass potential in many Tenda devices. This is NOT a false-positive high-CVSS issue—the combination of remote code execution capability, public exploits, and widespread vulnerable device deployment makes this a genuine critical priority.

An authenticated attacker (either via brute-forced default credentials 'admin/admin' common to Tenda devices, or as a legitimately provisioned user on an enterprise network) sends a crafted HTTP POST request to /goform/GstDhcpSetSer with an oversized payload in the 'dips' parameter (e.g., a string significantly longer than the buffer's allocated size—potentially 256+ bytes). The vulnerable strcpy() or similar unsafe copy function in the GstDhcpSetSer function does not validate input length, causing a stack buffer overflow. This overwrites adjacent stack memory, including the function return pointer. The attacker crafts the payload to include shellcode and a return address pointing to the injected code, achieving arbitrary code execution running with the privilege level of the web server process (often root on embedded routers). Subsequent actions: the attacker installs a persistent backdoor, modifies firewall rules to enable port forwarding, joins the device to a botnet, or exfiltrates network credentials. With public POC available, automated scanning and exploitation of unpatched Tenda FH1202 devices is feasible at scale.