The Tenda FH1201 router firmware version 1.2.0.14(408) contains a stack-based buffer overflow vulnerability in the formWrlExtraSet function within the /goform/WrlExtraSet parameter handler. An attacker can remotely manipulate the GO argument to cause a buffer overflow on the stack, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code has been published, but no known active exploitation has been reported. No vendor patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected Tenda FH1201 device. The vulnerability impacts confidentiality, integrity, and availability of the device. Given the remote attack vector and lack of required privileges or user interaction, the risk is significant for exposed devices running the vulnerable firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, affected users should consider disabling remote management features if enabled, restricting network access to the device, or replacing the device with a non-vulnerable model. Monitor the vendor's website and security advisories for updates regarding patches or official mitigations.