Tenda FH1202 EUVD-2026-25710

Exploitation requires valid credentials to the Tenda FH1202 web administration interface (CVSS PR:L - low-privileged authentication required). Attackers must successfully authenticate via HTTP/HTTPS to the router's management portal, typically accessible on TCP ports 80 or 443. The vulnerability is exploitable against default router configurations running firmware version 1.2.0.14(408) - no additional features or non-default settings need to be enabled. The /goform/WrlExtraSet endpoint is part of the standard web interface functionality. Exploitation is limited by the need for credential access, either through default passwords (common in SOHO routers), credential reuse, brute-force attacks, or social engineering. No user interaction required beyond initial attacker authentication (UI:N). Remote network access to the management interface (AV:N) is required-devices with WAN-side management disabled or restricted to internal networks are not exploitable from the internet.

Real-world risk is moderate-to-high for targeted attacks but lower for mass exploitation. The CVSS 7.4 score reflects complete system compromise potential (VC:H/VI:H/VA:H) with network attack vector, but PR:L (low privilege required) acts as a significant barrier to automated exploitation. The publicly available POC on GitHub (confirmed exploit reference) means attackers have working code, reducing time-to-exploit. However, CVSS 4.0 E:P (Proof-of-concept) indicates exploitation is not yet widespread or automated in attack tools. The attack complexity is low (AC:L) once credentials are obtained, making this attractive for targeted attacks against organizations using these routers with default credentials. Key risk factors: (1) Consumer/SOHO routers frequently retain default credentials, (2) Authenticated exploits are less likely to trigger IDS/IPS than unauthenticated ones, (3) Router compromise enables network-wide lateral movement and traffic interception. Risk is constrained by the requirement for valid credentials and the relatively small install base of this specific Tenda model. No EPSS or KEV data provided, but lack of KEV listing suggests exploitation remains theoretical or limited rather than widespread in attacker campaigns. Organizations should prioritize patching if these routers are internet-facing or accessible to untrusted internal users.

An attacker identifies a Tenda FH1202 router exposed on the internet via Shodan or similar scanning. Using the default or common credentials ('admin/admin'), they authenticate to the web interface and send a crafted HTTP POST request to /goform/WrlExtraSet with an oversized 'Go' parameter value (e.g., 2000+ bytes). The WrlExtraSet function copies this input to a stack buffer without bounds checking, overwriting adjacent memory including the saved return address. The attacker's payload executes arbitrary shellcode as the httpd process (likely root on embedded devices), granting full router control to intercept traffic, pivot to internal networks, or deploy persistent backdoors. The GitHub POC provides ready-made exploit code, reducing technical barriers.