CVE-2026-9429
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in Tenda F1202 1.2.0.20(408) affects the formWrlExtraSet function in the file /goform/WrlExtraSet. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes remote code execution or device crash, potentially leading to compromise of the router and network.
Recommendation
Immediately update the Tenda F1202 firmware to the latest version or replace the device with a patched model.
Other vulnerabilities in Tenda F1202
See all- CVE-2026-9431High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function fromPptpUserAdd of the file /goform/PptpUserAdd. Manipulating the opttype argument can cause a buffer overflow.
- CVE-2026-9430High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Manipulating the dips argument can cause a buffer overflow.
- CVE-2026-9428High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the fromPPTPUserSetting function in the file /goform/PPTPUserSetting. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. Performing a manipulation of the argument delno results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.