The vulnerability CVE-2026-9428 affects Tenda F1202 firmware version 1.2.0.20(408). It is a stack-based buffer overflow triggered by manipulating the delno argument in the fromPPTPUserSetting function of the /goform/PPTPUserSetting endpoint. This flaw allows remote attackers to cause memory corruption, potentially leading to denial of service or arbitrary code execution. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or vendor advisory at this time.

Successful exploitation of this vulnerability may allow remote attackers to execute arbitrary code or cause a denial of service on affected Tenda F1202 devices. The vulnerability impacts confidentiality, integrity, and availability with high severity. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interfaces to trusted sources only and monitor for unusual behavior. Avoid exposing the device's management interface to untrusted networks.