Which versions of Tenda FH1202 are affected by CVE-2026-7034?

CVE-2026-7034 affects Tenda FH1202 routers running firmware 1.2.0.14(408), allowing authenticated attackers to execute arbitrary code through a stack buffer overflow.

Is there a public PoC exploit available for CVE-2026-7034?

Yes, a public proof-of-concept exploit is available for CVE-2026-7034. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7034?

Within 24 hours: Identify all Tenda FH1202 devices running firmware 1.2.0.14(408) in your environment using network inventory tools; disable remote management if enabled. Within 7 days: Change all default/weak credentials on identified devices; implement network segmentation to restrict unauthenticated access to router management interfaces. Within 30 days: Monitor Tenda advisories for firmware updates beyond 1.2.0.14(408); evaluate replacement or alternative equipment if no patch timeline is published by vendor.

Tenda FH1202 CVE-2026-7034

Q: What is the CVSS score of CVE-2026-7034?

CVE-2026-7034 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25710 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-26 VulDB

Buffer Overflow Tenda Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:10 vuln.today

Public exploit code

Analysis Updated

Apr 26, 2026 - 12:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 26, 2026 - 12:22 vuln.today

cvss_changed

CVSS changed

Apr 26, 2026 - 12:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 26, 2026 - 11:45 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 11:30 euvd

EUVD-2026-25710

Analysis Generated

Apr 26, 2026 - 11:30 vuln.today

CVE Published

Apr 26, 2026 - 11:00 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda FH1202 router firmware 1.2.0.14(408) allows authenticated remote attackers to execute arbitrary code via crafted 'Go' parameter to the /goform/WrlExtraSet endpoint in the httpd service. A public proof-of-concept exploit exists (GitHub), enabling reliable exploitation despite low attack complexity. CVSS 7.4 (High) severity reflects significant impact potential, though exploitation requires valid user credentials (PR:L), limiting mass-scale attacks to scenarios where default/weak credentials are common in Tenda routers.

Technical ContextAI

This vulnerability affects the httpd web server component in Tenda FH1202 wireless router firmware version 1.2.0.14(408). The WrlExtraSet function in /goform/WrlExtraSet fails to properly validate the length of user-supplied input to the 'Go' parameter before copying it to a fixed-size stack buffer, causing CWE-121 (stack-based buffer overflow). The CVSS vector indicates network-accessible attack surface (AV:N) with low complexity (AC:L), requiring only low-privilege authentication (PR:L). The vulnerability exists in the router's web management interface, which typically uses HTTP/HTTPS protocols for configuration. Stack-based overflows in embedded device web interfaces are particularly dangerous because they can overwrite return addresses and function pointers on the call stack, enabling control flow hijacking. The affected CPE (cpe:2.3:a:tenda:fh1202) identifies this as application-level firmware running on dedicated hardware.

RemediationAI

Check Tenda's official support site (https://www.tenda.com.cn/) for firmware updates addressing CVE-2026-7034 for FH1202 routers. No patched firmware version is confirmed in available intelligence at time of analysis. Until a patch is released, implement the following compensating controls: (1) Change all default administrative credentials to complex passwords (20+ characters, alphanumeric with symbols) to eliminate the primary attack vector, since exploitation requires PR:L authentication. (2) Disable remote management interfaces entirely and restrict web administration access to trusted internal networks only via firewall rules-block WAN-side access to ports 80/443/8080. This prevents network-based exploitation (AV:N) while maintaining local management capability. Trade-off: administrators lose remote configuration ability. (3) Place affected routers behind a separate gateway device if used in production environments, limiting their role to switching/wireless only rather than internet-facing routing. (4) Monitor authentication logs for brute-force attempts against the web interface. (5) If feasible, replace affected devices with alternative models from vendors with active security support programs. Reference the public POC at https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_19/README.md to understand attack mechanics and validate defensive controls.