CVE-2026-5045 Overview
CVE-2026-5045 is a stack-based buffer overflow vulnerability affecting Tenda FH1201 routers running firmware version 1.2.0.14(408). The flaw resides in the WrlclientSet function handling requests to the /goform/WrlclientSet endpoint within the Parameter Handler component. Manipulation of the GO argument triggers the overflow condition [CWE-119]. Attackers can exploit this vulnerability remotely over the network, and the exploit has been publicly disclosed. Successful exploitation can lead to arbitrary code execution on the device or a denial-of-service condition affecting network availability.
Critical Impact
Remote attackers with low privileges can corrupt stack memory through the GO parameter, potentially achieving code execution on affected Tenda FH1201 routers with public exploit code available.
Affected Products
- Tenda FH1201 router (hardware)
- Tenda FH1201 firmware version 1.2.0.14(408)
- Parameter Handler component (/goform/WrlclientSet endpoint)
Discovery Timeline
- 2026-03-29 - CVE-2026-5045 published to NVD
- 2026-03-30 - Last updated in NVD database
Technical Details for CVE-2026-5045
Vulnerability Analysis
The vulnerability is classified under [CWE-119] as an improper restriction of operations within the bounds of a memory buffer. The affected WrlclientSet function processes HTTP requests sent to the /goform/WrlclientSet URI on the router's management interface. When the function reads the GO argument from the incoming request, it copies the data onto a fixed-size stack buffer without validating the input length.
An attacker supplying an oversized GO value can overwrite adjacent stack memory, including saved return addresses and function pointers. This corruption may divert execution to attacker-controlled data. The Tenda FH1201 firmware runs on MIPS-based embedded hardware with limited exploit mitigations, increasing the practical exploitability of stack overflows in router binaries.
Root Cause
The root cause is the absence of bounds checking when copying user-supplied input from the GO HTTP parameter into a stack-allocated buffer inside the WrlclientSet handler. Functions such as strcpy or sprintf used without length validation produce these conditions in goform handlers across Tenda firmware. Authentication is required to reach the handler, but the bar is low because the attacker only needs valid session access to the router's web administration interface.
Attack Vector
Exploitation requires network access to the router's web management interface, typically TCP port 80. The attacker sends a crafted HTTP POST request to /goform/WrlclientSet containing an oversized GO parameter value. The overflow corrupts the stack frame of WrlclientSet, allowing control of execution flow. Public exploit material has been published in the referenced GitHub Vulnerability Database Readme and the VulDB #353968 advisory.
No verified proof-of-concept code is reproduced here. Refer to the VulDB #353968 CTI Analysis for technical exploitation details.
Detection Methods for CVE-2026-5045
Indicators of Compromise
- HTTP POST requests to /goform/WrlclientSet containing abnormally long GO parameter values exceeding expected length boundaries.
- Unexpected reboots, web service crashes, or httpd process restarts on Tenda FH1201 devices.
- Outbound connections from the router to unfamiliar IP addresses, indicating possible post-exploitation activity.
- Modified router configurations or new administrative sessions originating from untrusted networks.
Detection Strategies
- Monitor router HTTP traffic for requests to goform endpoints containing parameters exceeding typical lengths, especially GO in WrlclientSet.
- Inspect network flows for protocol anomalies and oversized POST bodies directed at router management interfaces.
- Apply intrusion detection signatures matching the URI pattern /goform/WrlclientSet combined with payload length thresholds.
Monitoring Recommendations
- Centralize router and gateway logs in a SIEM platform to correlate management-plane access with downstream behavior.
- Alert on administrative interface access from non-management network segments or external IP ranges.
- Track CPU and memory anomalies on edge devices to identify potential exploitation attempts that destabilize the firmware.
How to Mitigate CVE-2026-5045
Immediate Actions Required
- Restrict access to the router's web administration interface to trusted internal management subnets only.
- Disable remote WAN-side management on the Tenda FH1201 until a patched firmware version is available.
- Change default administrator credentials and enforce strong, unique passwords on the router.
- Segment IoT and consumer-grade networking equipment away from sensitive infrastructure.
Patch Information
No official patch has been published by the vendor at the time of disclosure. The Tenda Official Website should be monitored for firmware updates addressing the WrlclientSet handler. Organizations using the FH1201 in production should consider replacing the device with a supported model if a fix is not released in a reasonable timeframe.
Workarounds
- Place the router behind an upstream firewall that blocks inbound HTTP/HTTPS to the management interface.
- Apply ACLs limiting source IP addresses permitted to reach the router's administrative port.
- Deploy a web application firewall or reverse proxy that filters oversized parameters in requests to goform endpoints.
- Decommission affected FH1201 devices if compensating controls cannot be implemented.
# Example iptables rule to restrict router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
