This vulnerability affects Tenda FH1202 firmware version 1.2.0.14(408) in the httpd component's WrlExtraSet function. Specifically, improper handling of the Go argument leads to a stack-based buffer overflow condition. The vulnerability is remotely exploitable without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The CVSS v4.0 base score is 8.7, indicating high severity. No patch or official remediation level is currently documented, and the vendor has not released an advisory or fix. The exploit code has been made public, increasing the risk of exploitation, although no active exploitation has been observed.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the remote, unauthenticated nature of the vulnerability and the high CVSS score, the impact on device confidentiality, integrity, and availability is high. However, there are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor channels for updates and apply patches promptly once released.