PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9429 Tenda CVE debrief

A stack-based buffer overflow vulnerability exists in the Tenda F1202 wireless router firmware version 1.2.0.20(408). The vulnerability is located in the `formWrlExtraSet` function within the `/goform/WrlExtraSet` endpoint, where improper handling of the `delno` parameter allows remote attackers to trigger memory corruption. The attack vector is network-accessible with low attack complexity and requires low privileges, making exploitation feasible for authenticated remote attackers. The vulnerability has been publicly disclosed with proof-of-concept materials available, increasing the risk of active exploitation. The affected product is an end-of-life consumer router with no anticipated firmware updates from the vendor.

Vendor
Tenda
Product
F1202
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Organizations operating Tenda F1202 routers in production environments, managed service providers with consumer-grade router deployments, security teams responsible for embedded device security, and network administrators maintaining legacy infrastructure with limited vendor support.

Technical summary

The vulnerability resides in the `formWrlExtraSet` function of the Tenda F1202 firmware's web management interface. The `delno` parameter lacks proper bounds validation, permitting stack-based buffer overflow when processing maliciously crafted HTTP POST requests to `/goform/WrlExtraSet`. Successful exploitation could result in arbitrary code execution with elevated privileges on the affected device. The attack requires network connectivity to the router's management interface and valid low-privilege credentials or session context.

Defensive priority

HIGH

Recommended defensive actions

  • Segment or restrict network access to Tenda F1202 management interfaces; disable remote administration if enabled
  • Replace Tenda F1202 routers with actively supported alternatives; this model appears end-of-life with no security update commitment
  • Monitor for anomalous HTTP POST requests to /goform/WrlExtraSet containing oversized delno parameters
  • Review network logs for unauthorized access attempts to router administrative endpoints from unexpected source addresses
  • Implement network-level intrusion detection signatures for buffer overflow patterns in embedded device management protocols

Evidence notes

Vulnerability identified through VulDB submission 813912 and assigned CVE-2026-9429. CVSS 4.0 vector confirms network attack vector with low complexity. CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) classified as primary weakness types. Vendor attribution to Tenda based on reference domain evidence with low confidence requiring review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9429 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9429

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9429 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9429

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.