Fh1205 Firmware EUVD-2025-21339

This vulnerability presents CRITICAL real-world risk based on multiple convergent signals: (1) CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), and PR:L (low privileges required—standard user access) indicating broad exploitability; (2) Public POC disclosure significantly increases actual exploitation probability above typical CVSS assumptions; (3) Stack-based buffer overflow with clear code execution path provides HIGH technical impact (C:H, I:H, A:H); (4) Authentication requirement (PR:L) moderately reduces attack surface compared to unauthenticated flaws, but many Tenda routers have weak/default credentials; (5) Automatable exploitation via HTTP POST requests without user interaction increases practical risk; (6) SSVC assessment: Exploitation=Active (POC public), Automatable=Yes, Technical Impact=Total, resulting in immediate patch priority. This is NOT a high-CVSS-but-low-risk issue—it is a mature, weaponizable vulnerability affecting widespread consumer networking equipment.

An attacker with network access to the target router (or who has compromised a user account with legitimate access) navigates to or scripts an HTTP POST request to /goform/WifiExtraSet. The attacker crafts a malicious wpapsk_crypto parameter containing a lengthy string (e.g., >512 bytes) that overflows the stack buffer in the formWifiExtraSet function. By carefully constructing the overflow payload with shellcode or return-oriented programming (ROP) gadgets, the attacker corrupts the stack return address and gains code execution within the router's root context. From this point, the attacker can: install a persistent backdoor, exfiltrate network traffic, modify DNS settings for phishing/MITM attacks, pivot to internal network devices, or render the router inoperable (DoS). Public POC tools likely exist given disclosure status, reducing the skill barrier for script-kiddie level exploitation. A typical attack takes <5 minutes to execute once credentials or default access is available.