Which versions of Tenda F1202 are affected by EUVD-2026-31639?

Tenda F1202 router firmware 1.2.0.20(408) is vulnerable to code execution attacks that could compromise router functionality and expose all network traffic to interception or manipulation.

Is there a public PoC exploit available for EUVD-2026-31639?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31639. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31639?

Within 24 hours: Identify and catalog all Tenda F1202 routers deployed in your network and confirm their firmware versions. Within 7 days: Implement strict access controls limiting administrative connections to these routers; disable WAN-accessible management interfaces and remote administration. Within 30 days: Contact Tenda for patch timeline; if no patch is available by day 30, execute device replacement or implement compensating controls permanently.

Tenda F1202 EUVD-2026-31639

Q: What is the CVSS score of EUVD-2026-31639?

EUVD-2026-31639 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9431 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-545r-9pqj-cc7g

Tenda Stack Overflow Buffer Overflow F1202

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:17 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was identified in Tenda F1202 1.2.0.20(408). This affects the function fromPptpUserAdd of the file /goform/PptpUserAdd. The manipulation of the argument opttype leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in Tenda F1202 router firmware 1.2.0.20(408) allows authenticated remote attackers to corrupt memory via the opttype parameter in the fromPptpUserAdd function at /goform/PptpUserAdd, enabling potential arbitrary code execution with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB-referenced PoC on GitHub), though EPSS rates exploitation probability low at 0.05% and the issue is not on CISA KEV.

Technical ContextAI

The Tenda F1202 is a SOHO/SMB wireless router whose web management interface exposes /goform/ endpoints implemented in native C handlers. The vulnerable function fromPptpUserAdd processes PPTP VPN user-add requests, and the opttype argument is copied into a fixed-size stack buffer without bounds validation - the classic CWE-121 (Stack-based Buffer Overflow) pattern common in MIPS/ARM embedded firmware where stack canaries, ASLR, and NX are frequently absent or weakly applied, making memory corruption directly convertible to control-flow hijack. CPE cpe:2.3:a:tenda:f1202:*:*:*:*:*:*:*:* indicates the application-level firmware component is the affected surface.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware build in the referenced data, so contact Tenda support (https://www.tenda.com.cn/) and monitor for an updated 1.2.0.x release that supersedes 1.2.0.20(408). As compensating controls, disable the PPTP VPN server feature in the router's admin UI if not in use to eliminate the vulnerable code path (side effect: any in-place PPTP VPN clients lose connectivity), restrict access to the web management interface to a trusted management VLAN or specific admin host so unauthenticated network reachability to /goform/PptpUserAdd is removed, and change default administrator credentials plus enforce strong unique passwords to raise the PR:L bar. WAN-side admin access should be disabled outright; for additional defense, place the device behind an upstream firewall blocking inbound HTTP/HTTPS to the router and consider replacing end-of-life Tenda hardware if no firmware fix appears.