The Tenda FH1202 router firmware version 1.2.0.14(408) contains a stack-based buffer overflow vulnerability in the WrlExtraSet function of the httpd component, accessible via the /goform/WrlExtraSet endpoint. The vulnerability is triggered by manipulating the Go argument, leading to memory corruption on the stack. This flaw can be exploited remotely without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been published by the vendor as of the current information.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the remote attack vector and lack of required privileges or user interaction, the impact is significant for affected devices running the specified firmware version. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor channels for updates regarding patches or official mitigations.