A critical stack-based buffer overflow in the Tenda FH1202 router, reachable via the /goform/NatSaticSetting endpoint, poses a severe risk of remote code execution.

The vulnerability exists in the fromNatStaticSetting function within the httpd service. An attacker with low privileges can trigger a stack-based buffer overflow by sending a crafted request to the /goform/NatSaticSetting endpoint, specifically by manipulating the page parameter without proper length validation.

The vulnerability carries a high CVSS score of 8.8, reflecting the potential for complete system compromise. Successful exploitation allows an attacker to execute arbitrary code or cause a permanent denial of service, which could lead to unauthorized access to internal network traffic, loss of router control, and potential lateral movement into the connected private network.

Immediate Action: Since no official patch is currently available, immediately restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/NatSaticSetting endpoint, which may indicate attempts to exploit this buffer overflow.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long input strings sent to the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher write-up linked by the CVE record.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant security risk. Administrators must prioritize isolating the affected Tenda FH1202 units from untrusted networks and monitor for vendor-provided firmware updates. If the device cannot be secured, it should be removed from service until a patch is applied.