A stack-based buffer overflow vulnerability (CVE-2026-9428) affects Tenda F1202 router firmware version 1.2.0.20(408). The issue arises from improper input validation of the delno argument in the fromPPTPUserSetting function located in /goform/PPTPUserSetting. This flaw allows remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or remediation level has been disclosed by the vendor, and no cloud service is involved. Public exploit code has been disclosed, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. The vulnerability is remotely exploitable without requiring privileges or user interaction, increasing its risk. However, no confirmed reports of exploitation in the wild exist at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by Tenda, users should monitor the vendor's communications for updates. Until a patch is available, consider limiting remote access to the affected device and applying network-level protections to reduce exposure.