A critical stack-based buffer overflow in Tenda FH1205 routers exposes the device to remote code execution and service disruption.

The vulnerability exists within the formWifiExtraSet function, where the wpapsk_crypto parameter is passed to a strcpy operation without sufficient length validation. This memory corruption flaw allows a logged-in attacker to overflow the stack, potentially leading to arbitrary code execution.

Successful exploitation of this vulnerability could allow an attacker to gain full control over the affected network device. This poses a significant risk to organizational infrastructure, as compromised routers can be used to intercept traffic, pivot into internal networks, or cause permanent service outages. With a CVSS score of 8.8, this represents a high-severity threat to network integrity and availability.

Immediate Action: As no official patch is currently identified, administrators should immediately restrict administrative access to the device management interface to trusted networks only. If possible, isolate the device from external network exposure until a manufacturer-supplied firmware update is available.

Proactive Monitoring: Monitor system logs for repeated crash events or unusual POST requests directed at the /goform/WifiExtraSet endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long payloads sent to the wpapsk_crypto parameter.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked research write-up on GitHub.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability should be treated as a high-priority risk. Administrators must limit access to the vulnerable interface immediately and monitor vendor channels for the release of a security update. Do not rely on internal network boundaries alone, as this device remains susceptible to lateral movement if an attacker gains entry to the local network.