PatchSiren cyber security CVE debrief
CVE-2026-9429 Tenda CVE debrief
A stack-based buffer overflow vulnerability exists in the Tenda F1202 wireless router firmware version 1.2.0.20(408). The vulnerability is located in the `formWrlExtraSet` function within the `/goform/WrlExtraSet` endpoint, where improper handling of the `delno` parameter allows remote attackers to trigger memory corruption. The attack vector is network-accessible with low attack complexity and requires low privileges, making exploitation feasible for authenticated remote attackers. The vulnerability has been publicly disclosed with proof-of-concept materials available, increasing the risk of active exploitation. The affected product is an end-of-life consumer router with no anticipated firmware updates from the vendor.
- Vendor
- Tenda
- Product
- F1202
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations operating Tenda F1202 routers in production environments, managed service providers with consumer-grade router deployments, security teams responsible for embedded device security, and network administrators maintaining legacy infrastructure with limited vendor support.
Technical summary
The vulnerability resides in the `formWrlExtraSet` function of the Tenda F1202 firmware's web management interface. The `delno` parameter lacks proper bounds validation, permitting stack-based buffer overflow when processing maliciously crafted HTTP POST requests to `/goform/WrlExtraSet`. Successful exploitation could result in arbitrary code execution with elevated privileges on the affected device. The attack requires network connectivity to the router's management interface and valid low-privilege credentials or session context.
Defensive priority
HIGH
Recommended defensive actions
- Segment or restrict network access to Tenda F1202 management interfaces; disable remote administration if enabled
- Replace Tenda F1202 routers with actively supported alternatives; this model appears end-of-life with no security update commitment
- Monitor for anomalous HTTP POST requests to /goform/WrlExtraSet containing oversized delno parameters
- Review network logs for unauthorized access attempts to router administrative endpoints from unexpected source addresses
- Implement network-level intrusion detection signatures for buffer overflow patterns in embedded device management protocols
Evidence notes
Vulnerability identified through VulDB submission 813912 and assigned CVE-2026-9429. CVSS 4.0 vector confirms network attack vector with low complexity. CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) classified as primary weakness types. Vendor attribution to Tenda based on reference domain evidence with low confidence requiring review.
Official resources
Public disclosure occurred on 2026-05-25 with exploit materials published. No CISA KEV listing as of analysis date.