Which versions of Tenda are affected by CVE-2026-5046?

Tenda FH1201 router firmware 1.2.0.14(408) contains a stack-based buffer overflow vulnerability (CVE-2026-5046, CVSS 8.8) that allows authenticated attackers to execute arbitrary code or disable the…

Is there a public PoC exploit available for CVE-2026-5046?

Yes, a public proof-of-concept exploit is available for CVE-2026-5046. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5046?

Within 24 hours: Inventory all Tenda FH1201 devices in production and identify firmware version 1.2.0.14(408); immediately disable remote administration and restrict network access to the affected routers via firewall rules blocking inbound connections to port 80/443 from untrusted networks. Within 7 days: Check Tenda's security advisory page for firmware updates beyond 1.2.0.14(408); if available, stage patching for low-risk devices first. Within 30 days: Complete migration to patched firmware or replace with alternative vendor equipment if patch availability remains unclear; reset all router admin credentials to complex values and enforce network segmentation.

Tenda CVE-2026-5046

Q: What is the CVSS score of CVE-2026-5046?

CVE-2026-5046 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17033 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-29 VulDB

Tenda Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 15:46 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 14:30 euvd

EUVD-2026-17033

Analysis Generated

Mar 29, 2026 - 14:30 vuln.today

CVE Published

Mar 29, 2026 - 14:15 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda FH1201 router firmware 1.2.0.14(408) allows authenticated remote attackers to execute arbitrary code or cause denial of service via crafted 'GO' parameter to the /goform/WrlExtraSet endpoint. CVSS 8.8 reflects high impact but requires low-privilege authentication (PR:L). Publicly available exploit code exists, demonstrating concrete exploitability. EPSS data not provided, but the combination of available POC and network accessibility elevates real-world risk for internet-exposed devices with default or weak credentials.

Technical ContextAI

This vulnerability affects the formWrlExtraSet function within the Parameter Handler component of Tenda FH1201 wireless router firmware, specifically when processing requests to /goform/WrlExtraSet. The root cause is CWE-121 (stack-based buffer overflow), a memory corruption flaw where unchecked input to the 'GO' parameter writes beyond allocated stack buffer boundaries. Tenda FH1201 is a consumer-grade wireless router; the affected firmware version 1.2.0.14(408) processes network configuration requests through CGI-style /goform endpoints. Stack overflows in embedded device firmware often occur in C/C++ code lacking bounds checking on string copy operations, allowing attackers to overwrite return addresses and hijack execution flow. The CPE identifier cpe:2.3:a:tenda:fh1201 confirms this affects the FH1201 product line application firmware.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor reference (https://www.tenda.com.cn/) provides no direct security advisory link in the available data. Users should immediately check Tenda's official support portal for firmware updates newer than 1.2.0.14(408) and apply if available. As interim mitigations: disable remote management access to the router's web interface, restrict administrative access to trusted internal IP addresses only via firewall rules, change default administrative credentials to strong unique passwords, and monitor for unauthorized configuration changes. If the device must remain internet-accessible, place it behind a dedicated firewall with strict ingress filtering. Organizations should consider hardware replacement if vendor support has ended or no patch materializes within acceptable risk windows, as consumer router vendors often discontinue security support for older models.