Description
A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-04-26
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

A firmware flaw in the Tenda FH1202 router, version 1.2.0.14(408), allows a malicious client to send a specially crafted HTTP request to the /goform/WrlExtraSet endpoint. The Go parameter passed to the WrlExtraSet function is not properly validated, causing a stack-based buffer overflow (CWE-119 and CWE-121). An attacker can trigger this bug remotely, potentially executing arbitrary code on the device and compromising its confidentiality, integrity, and availability.

Affected Systems

The vulnerability is identified for the Tenda FH1202 router running firmware 1.2.0.14(408). No other firmware versions or additional products are listed as affected in the available data.

Risk and Exploitability

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the vulnerability is not yet catalogued in the CISA KEV list. Nevertheless, a publicly available exploit demonstrates that an attacker can automate the overflow, which makes the risk significant for devices that expose the web management interface to the internet.

Generated by OpenCVE AI on April 28, 2026 at 19:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Flash the router with the latest firmware version released by Tenda that includes a fix for the WrlExtraSet buffer overflow.
  • Restrict access to the device’s web management interface by limiting it to a trusted local subnet or disabling remote HTTP access until a patched firmware image is available.
  • Configure the device’s firewall or a network ACL to block HTTP requests to the /goform/WrlExtraSet endpoint, preventing exploitation attempts while a patch is pending.

Generated by OpenCVE AI on April 28, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:tenda:fh1202:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:fh1202_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*

Mon, 27 Apr 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda fh1202
Vendors & Products Tenda fh1202

Mon, 27 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 26 Apr 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
Title Tenda FH1202 httpd WrlExtraSet stack-based overflow
First Time appeared Tenda
Tenda fh1202 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:fh1202_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda fh1202 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Fh1202 Fh1202 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-27T12:47:47.994Z

Reserved: 2026-04-25T14:22:54.448Z

Link: CVE-2026-7034

cve-icon Vulnrichment

Updated: 2026-04-27T12:47:43.201Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-26T12:16:21.570

Modified: 2026-04-30T14:10:42.487

Link: CVE-2026-7034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T20:00:19Z

Weaknesses