Tenda F1202 CVE-2026-9431

Attacker must have authenticated access to the Tenda F1202 web administration interface (CVSS PR:L - low-privilege credentials sufficient) and network reachability to the /goform/PptpUserAdd endpoint, which by default is exposed only on the LAN side. The vulnerable code path lives in the PPTP user-management handler fromPptpUserAdd, so it is reachable whenever the management UI is running (it does not require the PPTP server feature to be actively configured, only that the handler accept the request). Exploitation is limited to firmware build 1.2.0.20(408) of the F1202; no user interaction is required (UI:N), and remote WAN exploitation is only possible where remote admin has been explicitly enabled.

CVSS 4.0 scores 7.4 (High) with AV:N/AC:L/PR:L/UI:N and high impact on C/I/A of the vulnerable component (VC:H/VI:H/VA:H) but no subsequent-system impact, reflecting compromise limited to the router itself. The PR:L requirement means the attacker needs at least low-privileged credentials to the admin interface - a meaningful barrier on internet-exposed devices but trivial on LANs where default credentials are common. SSVC corroborates this as poc-level exploitation, not automatable, with total technical impact, and EPSS at 0.05% (14th percentile) signals no observed mass exploitation. The publicly available PoC raises baseline risk for opportunistic LAN-based attacks (malicious insiders, compromised endpoints pivoting), but absence from CISA KEV and the authentication requirement mean this is a serious-but-not-emergency issue - prioritize for devices with weak/default credentials or WAN-exposed admin panels.

An attacker who has obtained low-privileged web UI credentials (default, reused, or phished) - or a malicious user on the LAN where the admin panel is reachable - sends a crafted HTTP POST to /goform/PptpUserAdd with an oversized opttype value, triggering the stack overflow in fromPptpUserAdd and overwriting the saved return address. The publicly available PoC at github.com/Litengzheng/vuldb_new2 demonstrates the crash primitive, and on typical embedded MIPS/ARM Linux firmware lacking ASLR/NX this is convertible to arbitrary code execution as the web-admin process (commonly root), giving full router takeover, traffic interception, and a pivot into the internal network.