A stack‑based buffer overflow exists in the formWebTypeLibrary function of Tenda FH1202, triggered by manipulating the webSiteId argument in the /goform/webtypelibrary endpoint. The flaw exploits common buffer handling weaknesses (CWE‑119) and stack corruption (CWE‑121), allowing an attacker to corrupt memory and potentially execute arbitrary code on the router. The vulnerability exposes the router to remote exploitation through the web interface, which can lead to full system compromise, loss of confidentiality, integrity, and availability.

The affected equipment is the Tenda FH1202 router running firmware version 1.2.0.14(408). No other versions are listed in the advisory, but any device presenting the same firmware build is vulnerable.

CVSS scoring indicates a high severity of 8.7, while the EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not present in CISA’s KEV catalog, but a public exploit is available. Attackers can reach the vulnerable endpoint remotely, typically by sending crafted POST requests to /goform/webtypelibrary with an oversized webSiteId parameter, triggering the stack overflow and enabling code execution, as inferred from the description.