CVE-2026-9428
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in Tenda F1202 1.2.0.20(408) affects the fromPPTPUserSetting function in the file /goform/PPTPUserSetting. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes remote code execution or device crash, potentially leading to compromise of the router and network.
Recommendation
Immediately update the Tenda F1202 firmware to the latest version or replace the device with a patched model.
Other vulnerabilities in Tenda F1202
See all- CVE-2026-9431High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function fromPptpUserAdd of the file /goform/PptpUserAdd. Manipulating the opttype argument can cause a buffer overflow.
- CVE-2026-9430High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Manipulating the dips argument can cause a buffer overflow.
- CVE-2026-9429High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the formWrlExtraSet function in the file /goform/WrlExtraSet. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.