A critical stack-based buffer overflow vulnerability in Tenda FH1201 routers, specifically in the fromPptpUserAdd function, poses a risk of remote code execution or denial of service.

This vulnerability is a stack-based buffer overflow (CWE-121) caused by a lack of length validation on the modino parameter within the fromPptpUserAdd function in the /goform/PPTPDClient endpoint. An attacker with low privileges can trigger this memory corruption remotely by sending a crafted request.

The potential for remote code execution represents a significant security risk, as it could allow an attacker to gain full control over the affected network device. This could lead to unauthorized access to internal network traffic, data exfiltration, or complete system compromise. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent device takeover.

Immediate Action: As no official patch is currently identified, users should restrict access to the web management interface of the Tenda FH1201 and disable the PPTP client functionality if it is not strictly required for business operations.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/PPTPDClient endpoint and review system logs for signs of service instability or unexpected reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion detection system (IDS) with rules configured to inspect and block excessively long input strings sent to the modino parameter.

Public Exploit Available: Yes, a functional proof-of-concept script has been published via the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a credible threat to the integrity of network infrastructure. Administrators should prioritize isolating affected devices from public-facing networks until a vendor-supplied firmware update is released and applied.