CVE-2026-9431
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function fromPptpUserAdd of the file /goform/PptpUserAdd. Manipulating the opttype argument can cause a buffer overflow.
Risk Assessment
An attacker can remotely exploit this vulnerability to execute arbitrary code on the device, potentially leading to full compromise of the router and network.
Recommendation
Update the router firmware to the latest available version or apply security patches from the vendor.
Other vulnerabilities in Tenda F1202
See all- CVE-2026-9430High
In the Tenda F1202 router version 1.2.0.20(408), a stack-based buffer overflow exists in the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Manipulating the dips argument can cause a buffer overflow.
- CVE-2026-9429High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the formWrlExtraSet function in the file /goform/WrlExtraSet. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-9428High
A vulnerability in Tenda F1202 1.2.0.20(408) affects the fromPPTPUserSetting function in the file /goform/PPTPUserSetting. Manipulation of the delno argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in Tenda F1202 1.2.0.20(408). This affects the function fromPptpUserAdd of the file /goform/PptpUserAdd. The manipulation of the argument opttype leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.