EUVD-2026-31635
GHSA-8c47-56c4-8w57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed F1202 admin UI
-
DeliveryObtain admin credentials
-
ExploitAuthenticate to web interface
-
InstallPOST oversized delno to /goform/PPTPUserSetting
-
C2Overflow stack buffer in fromPPTPUserSetting
-
ExecuteHijack control flow on router
-
ImpactExecute code with admin privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to (1) reach the device's HTTP management interface - trivial on LAN, only possible from the internet if WAN-side remote management is enabled, and (2) authenticate as an administrative user (CVSS PR:L), so default/weak/leaked credentials or an existing admin session are prerequisites. The specific reachable feature is the PPTP VPN user configuration handler at /goform/PPTPUserSetting, invoking fromPPTPUserSetting with a malicious delno argument. Limiting factors: only firmware 1.2.0.20(408) of the Tenda F1202 is confirmed affected, no user interaction is needed once authenticated, and impact is bounded to the device itself (CVSS scope SC:N/SI:N/SA:N - no confirmed pivot to other systems beyond the router). |
| Impact | The CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network reach, low complexity, and high impact on the device, but PR:L means an attacker must already hold valid administrative credentials - a major practical limiter for an internet-exposed router. Despite publicly available exploit code, EPSS scores this at 0.05% (14th percentile), indicating very low predicted exploitation activity, and it is not on CISA KEV, suggesting only opportunistic or targeted use rather than mass exploitation. The realistic risk is moderate: defenders running F1202 devices with default/weak admin credentials, exposed WAN-side management, or credential reuse face genuine compromise risk, but the authentication requirement places this below internet-wormable router bugs. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed an administrative login to a Tenda F1202 - for example via default credentials on an internet-exposed device, phishing of an SMB admin, or credential reuse - submits a crafted POST to /goform/PPTPUserSetting with an overlong delno argument. The publicly disclosed proof-of-concept at https://github.com/Litengzheng/vuldb_new2 triggers the stack overflow in fromPPTPUserSetting, crashing the device and, with proper gadget chaining for the embedded architecture, hijacking control flow to execute attacker-supplied code on the router with full administrative privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to corrupt memory via the delno parameter of the /goform/PPTPUserSetting endpoint handled by fromPPTPUserSetting. Publicly available exploit code exists per VulDB disclosure, though EPSS rates the exploitation probability at only 0.05% (14th percentile) and no public exploit identified at time of analysis appears in CISA KEV. Successful exploitation can compromise confidentiality, integrity, and availability of the device.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware build for CVE-2026-9428 in the references provided. Until a fixed firmware appears at https://www.tenda.com.cn/, restrict the F1202 web administration interface to a trusted management VLAN and explicitly disable remote/WAN-side HTTP management to remove the network exposure that makes the issue reachable (trade-off: administrators must be on-LAN or use VPN to manage the device). Rotate the admin password to a long unique value and disable any unused PPTP VPN user accounts so the PR:L precondition is harder to satisfy, and monitor the VulDB advisory at https://vuldb.com/vuln/365409 for a fixed version. If the device is end-of-life or no fix materialises, plan replacement with a supported router as the durable mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda F1202 is a small-business/SOHO wireless router. The flaw lives in the web management binary's fromPPTPUserSetting handler tied to the /goform/PPTPUserSetting endpoint, which processes PPTP VPN user configuration submitted through the device's HTTP administration interface. CWE-121 (Stack-based Buffer Overflow) indicates the delno argument is copied into a fixed-size stack buffer without proper bounds checking - a recurring pattern in Tenda's goform CGI handlers where user-controlled query/POST parameters are passed to unsafe string routines such as strcpy or sprintf, overwriting the saved return address and adjacent stack frames on the MIPS/ARM SoC running the firmware.
Know when F1202 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A stack-based buffer overflow in Tenda F1202 router firmware (version 1.2.0.20.408) enables authenticated attackers to compromise the confidentiality, integrity, and availability of network infrastructure. Publicly available exploit code exists, yet no vendor patch is available, requiring organizations to implement immediate compensating controls.
No vendor-released patch identified at time of analysis. Deploy network-layer access controls limiting administrative connectivity to trusted networks, disable PPTP functionality where business requirements permit, implement packet inspection targeting the vulnerable endpoint, maintain detailed access logs for forensics, and prioritize these routers for replacement in the next hardware refresh cycle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to corrup
Stack-based buffer overflow in the Tenda F1202 router (firmware 1.2.0.20(408)) allows remote attackers to corrupt memory
Stack-based buffer overflow in the Tenda F1202 router (firmware 1.2.0.20(408)) allows remote attackers to corrupt memory
Exploit-DB