A critical stack-based buffer overflow in Tenda FH1201 firmware allows remote attackers to compromise device integrity and trigger code execution.

This vulnerability is a stack-based buffer overflow located in the WrlclientSet function of the /goform/WrlclientSet endpoint. An authenticated attacker can trigger the flaw by sending a specially crafted GO parameter, which lacks necessary length verification before being passed to internal memory-handling functions.

The exploitation of this vulnerability can result in full system compromise, including remote code execution or a persistent denial of service condition. Given the CVSS score of 8.8, this flaw represents a significant risk to network availability and security, as the device acts as a critical gateway for traffic. Unauthorized control over the router could lead to traffic interception, credential theft, or the use of the device as a pivot point for lateral movement within the local network.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the web management interface to trusted internal IP addresses only. If the device is exposed to the internet, disable remote management features immediately.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /goform/WrlclientSet, particularly those containing abnormally long strings in the GO parameter field.

Compensating Controls: Deploy a network-level Web Application Firewall or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing oversized GO parameters destined for the WrlclientSet endpoint.

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the technical write-up provided by the researcher on GitHub.

Given the availability of a public proof-of-concept and the high CVSS severity, this vulnerability poses a credible threat to the security of the affected Tenda FH1201 devices. Organizations should prioritize isolating these devices from external access and monitor for any signs of anomalous traffic or service instability. Until a firmware update is provided by Tenda, strict network segmentation and limiting administrative access are the most effective measures to mitigate the risk of remote compromise.