Tenda EUVD-2026-17033

Requires authenticated access to Tenda FH1201 firmware version 1.2.0.14(408). Attacker must send crafted HTTP request manipulating the GO parameter to /goform/WrlExtraSet endpoint. Remote exploitation possible; authentication credential required.

Real-world risk is elevated despite authentication requirement. CVSS 8.8 is justified by network attack vector (AV:N), low complexity (AC:L), and complete confidentiality/integrity/availability impact (C:H/I:H/A:H). The PR:L (low privilege required) reduces immediate risk compared to unauthenticated flaws, but consumer routers commonly have default credentials or weak passwords discoverable through credential stuffing. Publicly available exploit code (confirmed via GitHub POC) significantly lowers the skill barrier for attackers. No CISA KEV listing indicates no confirmed active exploitation campaigns at scale, but the POC demonstrates practical weaponization potential. For internet-facing Tenda FH1201 devices, especially those with unchanged default credentials, this represents a high-priority patching concern. Organizations using these routers in SOHO or branch office contexts should prioritize remediation. The CVSS Exploit Maturity of 'Proof-of-Concept' (E:P) aligns with available POC, while RL:X (remediation level not defined) suggests patch status is uncertain.

An attacker identifies internet-exposed Tenda FH1201 routers through Shodan or Censys scanning, targeting devices with default credentials (admin/admin). After authenticating to the web management interface with low-privilege credentials, the attacker sends a crafted HTTP POST request to /goform/WrlExtraSet with an oversized 'GO' parameter value exceeding stack buffer limits. The malicious payload overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that establishes a reverse shell or installs persistent backdoor firmware. With publicly available exploit code from the GitHub POC repository, even moderately skilled attackers can automate this attack against vulnerable device populations.