Fh1202 Firmware EUVD-2025-21260

CVSS 3.1 score of 8.8 (High/Critical severity) reflects the severe nature: Network-accessible (AV:N), Low attack complexity (AC:L), requires Low privileges (PR:L - authenticated user), and results in High impact across confidentiality, integrity, and availability. However, the PR:L requirement is a significant constraint—attackers must first obtain valid credentials. The public availability of exploit code (POC disclosed) elevates real-world risk substantially despite the authentication requirement. EPSS scoring would likely be elevated (est. 0.75+) given public POC availability. KEV status should be assumed as exploited given the public disclosure statement. The vulnerability is automatable and provides complete system compromise via RCE. SSVC assessment: Exploitation=Active (public POC), Automatable=Yes, Technical Impact=Total (code execution). Real-world priority is HIGH for any organization running Tenda FH1202 devices with internet exposure or within networks where internal attackers exist with router management access.

An authenticated attacker with valid router management credentials (obtained via credential compromise, phishing, or weak defaults) submits a crafted HTTP request to /goform/PPTPUserSetting with a maliciously oversized 'delno' parameter value. The parameter is passed directly to a fixed-size stack buffer in the fromPptpUserSetting function without bounds validation. The overflow overwrites the function's return address on the stack with the address of attacker-controlled shellcode (or ROP chain). Upon function return, execution jumps to the injected code, granting the attacker shell-level access to the router with root privileges. The attacker can then: (1) modify firewall rules for persistence, (2) exfiltrate network traffic, (3) pivot to internal network devices, or (4) launch attacks against connected clients. Public POC code likely uses simple buffer offset calculations to overwrite the return pointer, making exploitation straightforward even for moderately skilled attackers. The PR:L requirement means attacks are limited to scenarios where attackers already have management credentials or can socially engineer valid users into executing malicious requests.