EUVD-2026-31634
GHSA-v3rr-p395-8h3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. Performing a manipulation of the argument delno results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
AnalysisAI
Stack-based buffer overflow in the Tenda F1202 router (firmware 1.2.0.20(408)) allows remote attackers to corrupt memory by sending a crafted 'delno' parameter to the /goform/WrlExtraSet endpoint handled by the formWrlExtraSet function. Publicly available exploit code exists, though EPSS predicts only a 0.05% exploitation probability (14th percentile), and SSVC classifies the technical impact as total despite the attack not being automatable.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have network reachability to the Tenda F1202 router's web management interface (typically TCP port 80 on the LAN, or WAN if Remote Management is enabled) AND possess low-privilege authenticated credentials to the web UI (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and warrant careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege credentials to the router's web UI (via default credentials, phishing, or brute force) sends a crafted HTTP POST to /goform/WrlExtraSet with an oversized 'delno' parameter that overflows the stack buffer in formWrlExtraSet, overwriting the return address to achieve arbitrary code execution in the httpd process context. With publicly available exploit code on GitHub (Litengzheng/vuldb_new2), reproducing this attack requires minimal reverse-engineering effort, and successful exploitation yields full control of the router for traffic interception, DNS hijacking, or pivoting into the LAN. |
| Remediation | No vendor-released patch identified at time of analysis - Tenda has not published fixed firmware for the F1202 covering CVE-2026-9429. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all network infrastructure to identify Tenda F1202 devices and confirm whether they are running firmware version 1.2.0.20(408); document location and network criticality of each affected unit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today