A stack‑based buffer overflow exists in the Tenda FH1202 firmware 1.2.0.14, triggered by manipulating the Go argument to the fromWrlclientSet function in httpd. The overflow could allow an attacker to execute arbitrary code on the device, compromising confidentiality, integrity and availability of the router. The description states that the attack may be launched remotely and the exploit is publicly disclosed.

Tenda FH1202 routers running firmware version 1.2.0.14 are affected. No other firmware revisions are listed in the current definition.

The CVSS score of 8.7 indicates high severity and the EPSS score of less than 1% suggests a presently low likelihood of exploitation, although the existence of publicly available exploits makes the risk significant in practice. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a remote HTTP request to /goform/WrlclientSet, requiring the attacker to send a crafted Go parameter. The combination of high severity and remote reach warrants immediate attention.