Tenda F1202 CVE-2026-9429

Attacker must have network reachability to the Tenda F1202 router's web management interface (typically TCP port 80 on the LAN, or WAN if Remote Management is enabled) AND possess low-privilege authenticated credentials to the web UI (CVSS PR:L). The target must be running firmware 1.2.0.20(408) specifically. No user interaction is required (UI:N). Exploitation is limited by the requirement for valid web-UI credentials and the typical default that Tenda routers do not expose admin over WAN - meaning exposure is largely confined to LAN attackers or to deployments where remote administration was explicitly enabled or where default credentials remain in place.

Signals are mixed and warrant careful interpretation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reachable, low complexity, but requires low-level privileges (PR:L) - meaning the attacker needs at least basic authenticated access to the router's web interface, which limits drive-by exploitation. EPSS is very low at 0.05% (14th percentile) and SSVC marks Automatable: no, suggesting opportunistic mass exploitation is unlikely, but Technical Impact is rated 'total' (full device compromise) and a public PoC exists on GitHub. The vulnerability is NOT listed in CISA KEV, so there is no public exploit identified for active exploitation - only publicly available exploit code. For internet-exposed routers with weak or default credentials, the PR:L barrier is effectively trivial, which raises practical risk above what EPSS alone suggests. Note: SC:N/SI:N/SA:N (no subsequent system impact) appears inconsistent with a router compromise scenario where downstream LAN traffic could be intercepted - defenders should treat that scoring conservatively.

An attacker who has obtained low-privilege credentials to the router's web UI (via default credentials, phishing, or brute force) sends a crafted HTTP POST to /goform/WrlExtraSet with an oversized 'delno' parameter that overflows the stack buffer in formWrlExtraSet, overwriting the return address to achieve arbitrary code execution in the httpd process context. With publicly available exploit code on GitHub (Litengzheng/vuldb_new2), reproducing this attack requires minimal reverse-engineering effort, and successful exploitation yields full control of the router for traffic interception, DNS hijacking, or pivoting into the LAN.