EUVD-2026-31633
GHSA-rf9r-xx56-f4rm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach F1202 management interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitPOST oversized 'dips' to /goform/GstDhcpSetSer
-
InstallOverflow stack buffer in formGstDhcpSetSer
-
C2Overwrite saved return address
-
ExecuteExecute shellcode as router process
-
ImpactPersist for traffic interception or pivot
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the F1202's HTTP management interface (typically TCP/80 on the LAN, or WAN if remote management is enabled) and low-privilege authenticated access to that interface (CVSS PR:L), meaning the attacker must possess valid - even unprivileged - admin-panel credentials before triggering the formGstDhcpSetSer handler at /goform/GstDhcpSetSer with a manipulated 'dips' argument. Limiting factors: the device must be running firmware 1.2.0.20(408) specifically, the management UI must be reachable from the attacker's position, and credentials are needed; no user interaction is required (UI:N) and attack complexity is low (AC:L), so once these prerequisites are met exploitation is straightforward using the public PoC. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, E:P) produces a 7.4 base score reflecting network reach, low complexity, and high impact across confidentiality, integrity, and availability - but importantly PR:L indicates the attacker must hold at least low-level privileges (likely an authenticated session to the router admin interface). EPSS is very low at 0.05% (14th percentile) and the CVE is absent from CISA KEV, signalling no observed mass exploitation despite publicly available exploit code. The realistic risk is therefore moderate and largely confined to environments where the F1202 admin interface is exposed (LAN or, worse, WAN) and weak/default credentials remain in place; PR:L meaningfully limits drive-by mass exploitation compared with truly unauthenticated SOHO router bugs typically abused by botnets like Mirai. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege credentials to the F1202 web interface (e.g., via phishing, default credentials, or LAN foothold) sends a crafted HTTP POST to /goform/GstDhcpSetSer with an oversized 'dips' parameter, overflowing the stack buffer in formGstDhcpSetSer and overwriting the saved return address to redirect execution to attacker-controlled shellcode. Publicly available exploit code on GitHub (Litengzheng/vuldb_new2) lowers the barrier significantly, enabling reliable crash-to-code-execution and ultimately full router takeover for pivoting, traffic interception, or DNS hijacking. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Tenda F1202 router (firmware 1.2.0.20(408)) allows remote attackers to corrupt memory by sending a crafted 'dips' parameter to the formGstDhcpSetSer handler at /goform/GstDhcpSetSer. Publicly available exploit code exists (published via VulDB/GitHub), though EPSS rates real-world exploitation probability very low at 0.05%, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build in the referenced advisories (VulDB 365411 and NVD), so administrators should monitor https://www.tenda.com.cn/ for an updated firmware release for the F1202. Until a patched firmware is available, restrict access to the router's HTTP management interface by disabling WAN-side administration entirely, limiting LAN-side admin to a small management VLAN or specific source IPs via ACL, and replacing any default or weak admin credentials given that the PR:L vector requires attacker authentication; consider isolating or replacing the device in high-value environments since end-of-life Tenda SOHO routers historically receive slow or no firmware fixes. Trade-offs: blocking remote administration removes convenience for off-site management, and source-IP restrictions can break legitimate workflows if not coordinated with IT staff.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the web-management HTTP handler formGstDhcpSetSer implemented in the router's goform CGI interface, which is typical of Tenda's embedded Linux/BusyBox-based SOHO router firmware. The root cause is CWE-121 (Stack-based Buffer Overflow): the 'dips' argument from the HTTP request is copied into a fixed-size stack buffer without adequate length validation, allowing an attacker to overwrite the saved return address and adjacent stack data. The single affected CPE (cpe:2.3:a:tenda:f1202:*) confirms this is firmware-specific to the Tenda F1202 device, which is consumer/SMB networking hardware where memory protections (ASLR, stack canaries, NX) are frequently absent or partial, making such overflows readily weaponizable for control-flow hijack.
Know when F1202 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Tenda F1202 1.2.0.20(408). Affected by this issue is the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Executing a manipulation of the argument dips can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
The Tenda F1202 router running firmware 1.2.0.20(408) contains a stack-based buffer overflow in the DHCP configuration handler that enables remote attackers to corrupt memory, potentially compromising network infrastructure security and connected systems across the organization. Publicly available exploit code exists, but the vulnerability remains unlisted in CISA's Known Exploited Vulnerabilities catalog with measured real-world exploitation probability below 1%. Organizations should prioritize inventory and mitigation of affected devices to protect network perimeter integrity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to router administrative interfaces to authorized management networks only; (2) Deploy Web Application Firewall (WAF) rules to block requests to /goform/GstDhcpSetSer endpoint with anomalous 'dips' parameters; (3) Implement network segmentation isolating affected routers from production systems; (4) Enable comprehensive logging and monitoring for requests to the vulnerable handler; (5) Contact vendor to confirm patch release timeline and firmware availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to corrup
Stack-based buffer overflow in the Tenda F1202 router (firmware 1.2.0.20(408)) allows remote attackers to corrupt memory
Stack-based buffer overflow in the Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to co
Exploit-DB