A stack-based buffer overflow exists in the fromPptpUserAdd function of the Tenda F1202 router firmware. The vulnerability is triggered by manipulating the opttype argument sent to the /goform/PptpUserAdd endpoint. Attackers can remotely trigger the overflow, potentially allowing arbitrary code execution and resulting in compromise of the device’s confidentiality, integrity, and availability. The flaw is characterized by CWE-119 and CWE-121 weaknesses in input validation and stack handling.

Only the Tenda F1202 router running firmware 1.2.0.20(408) is known to be affected. No other Tenda products or firmware versions are listed as vulnerable in the current data.

The CVSS score of 8.7 classifies this flaw as high‑severity. Although the EPSS score is not available, the vulnerability is publicly exploitable and the exploit is already in circulation, indicating a realistic threat. The instance is not presently listed in the CISA KEV catalog. Attackers can exercise the flaw remotely without local access, so routine penetration testing should include attempts to trigger the PptpUserAdd endpoint to validate any mitigations.