CVE-2025-9806
LowCVSS 1.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. It affects an unknown function of the file /etc_ro/shadow in the Administrative Interface component. Manipulation with the input "Fireitup" causes hard-coded credentials. The attack can only be executed locally and requires a high degree of complexity.
Risk Assessment
A local attacker could exploit hard-coded credentials to gain unauthorized access to the administrative interface, potentially leading to device takeover.
Recommendation
Change default credentials and apply available firmware updates for Tenda F1202.
Other vulnerabilities in Tenda F1202
See all- CVE-2026-9431High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function fromPptpUserAdd of the file /goform/PptpUserAdd. Manipulating the opttype argument can cause a buffer overflow.
- CVE-2026-9430High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Manipulating the dips argument can cause a buffer overflow.
- CVE-2026-9429High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the formWrlExtraSet function in the file /goform/WrlExtraSet. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-9428High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the fromPPTPUserSetting function in the file /goform/PPTPUserSetting. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS