Which versions of Tenda F1202 are affected by CVE-2026-9428?

A stack-based buffer overflow in Tenda F1202 router firmware (version 1.2.0.20.408) enables authenticated attackers to compromise the confidentiality, integrity, and availability of network…

Is there a public PoC exploit available for CVE-2026-9428?

Yes, a public proof-of-concept exploit is available for CVE-2026-9428. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9428?

Within 24 hours: Inventory all Tenda F1202 routers in production and verify firmware version 1.2.0.20.408; disable remote administrative access and PPTP services if operationally feasible. Within 7 days: Implement network segmentation to restrict connectivity to affected devices and deploy monitoring on the /goform/PPTPUserSetting endpoint for exploit attempts. Within 30 days: Monitor Tenda security advisories for firmware patches; establish hardware replacement or alternative routing solution timeline if no patch becomes available.

Tenda F1202 CVE-2026-9428

Q: What is the CVSS score of CVE-2026-9428?

CVE-2026-9428 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31635 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-8c47-56c4-8w57

Tenda Stack Overflow Buffer Overflow F1202

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:31 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to corrupt memory via the delno parameter of the /goform/PPTPUserSetting endpoint handled by fromPPTPUserSetting. Publicly available exploit code exists per VulDB disclosure, though EPSS rates the exploitation probability at only 0.05% (14th percentile) and no public exploit identified at time of analysis appears in CISA KEV. Successful exploitation can compromise confidentiality, integrity, and availability of the device.

Technical ContextAI

The Tenda F1202 is a small-business/SOHO wireless router. The flaw lives in the web management binary's fromPPTPUserSetting handler tied to the /goform/PPTPUserSetting endpoint, which processes PPTP VPN user configuration submitted through the device's HTTP administration interface. CWE-121 (Stack-based Buffer Overflow) indicates the delno argument is copied into a fixed-size stack buffer without proper bounds checking - a recurring pattern in Tenda's goform CGI handlers where user-controlled query/POST parameters are passed to unsafe string routines such as strcpy or sprintf, overwriting the saved return address and adjacent stack frames on the MIPS/ARM SoC running the firmware.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware build for CVE-2026-9428 in the references provided. Until a fixed firmware appears at https://www.tenda.com.cn/, restrict the F1202 web administration interface to a trusted management VLAN and explicitly disable remote/WAN-side HTTP management to remove the network exposure that makes the issue reachable (trade-off: administrators must be on-LAN or use VPN to manage the device). Rotate the admin password to a long unique value and disable any unused PPTP VPN user accounts so the PR:L precondition is harder to satisfy, and monitor the VulDB advisory at https://vuldb.com/vuln/365409 for a fixed version. If the device is end-of-life or no fix materialises, plan replacement with a supported router as the durable mitigation.