A critical buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14 poses a high risk of remote code execution or system denial of service for affected network devices.

This is a stack-based buffer overflow (CWE-121) occurring within the formWrlclientSet function of the httpd component. An attacker with low-level access can trigger the vulnerability by sending a maliciously crafted POST request to the /goform/WrlclientSet endpoint, specifically manipulating the GO argument, which lacks adequate length validation.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to achieve remote code execution, which could lead to unauthorized access to the local network, sensitive data interception, or a complete denial of service. The ability to execute arbitrary code on networking infrastructure is a severe threat that compromises the integrity of the entire connected environment.

Immediate Action: Since no vendor-supplied patch is currently available, administrators should immediately isolate affected Tenda FH1202 devices from public-facing interfaces to prevent remote exploitation.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlclientSet endpoint and review device logs for signs of service crashes or unexpected process restarts.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to known, trusted internal IP addresses only. A Web Application Firewall may be configured to drop POST requests containing excessively long payloads in the GO parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Given the severity of this remote code execution flaw and the public availability of a proof-of-concept, immediate mitigation is required. Organizations should treat these devices as high-risk assets and enforce network-level access restrictions until a formal firmware update is released and applied.