What is the CVSS score of CVE-2026-3809?

CVE-2026-3809 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fh1202 Firmware are affected by CVE-2026-3809?

A HIGH severity vulnerability (CVE-2026-3809, CVSS 8.8) affects Tenda FH1202 network devices, allowing potential remote exploitation through a NAT configuration function.

Is there a public PoC exploit available for CVE-2026-3809?

Yes, a public proof-of-concept exploit is available for CVE-2026-3809. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3809?

Within 24 hours: Inventory all Tenda FH1202 devices running firmware 1.2.0.14(408) and isolate affected units from production networks if possible. Within 7 days: Implement network segmentation to restrict access to the vulnerable /goform/NatStaticSetting endpoint and apply WAF rules to block exploitation attempts. Within 30 days: Monitor Tenda's security advisories for patch availability; prepare and test firmware updates immediately upon release.

Fh1202 Firmware CVE-2026-3809

HIGH

Buffer Overflow (CWE-119)

2026-03-09 cna@vuldb.com

Buffer Overflow Stack Overflow Fh1202 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 09, 2026 - 15:30 vuln.today

Public exploit code

CVE Published

Mar 09, 2026 - 08:16 nvd

HIGH 8.8

DescriptionCVE.org

A flaw has been found in Tenda FH1202 1.2.0.14(408). The impacted element is the function fromNatStaticSetting of the file /goform/NatSaticSetting. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda FH1202 firmware version 1.2.0.14(408) allows remote authenticated attackers to achieve complete system compromise through manipulation of the page parameter in the /goform/NatStaticSetting function. Public exploit code exists for this vulnerability and no patch is currently available. The flaw requires valid credentials but can be exploited over the network with no user interaction.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Fh1202 Firmware. A flaw has been found in Tenda FH1202 1.2.0.14(408). The impacted element is the function fromNatStaticSetting of the file /goform/NatSaticSetting. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.