CVE-2026-9430: Tenda F1202 Buffer Overflow Vulnerability

CVE-2026-9430 Overview

CVE-2026-9430 is a stack-based buffer overflow vulnerability in the Tenda F1202 router running firmware version 1.2.0.20(408). The flaw resides in the formGstDhcpSetSer function handling requests to the /goform/GstDhcpSetSerof endpoint. Attackers can manipulate the dips argument to overflow the fixed-size stack buffer. The vulnerability is exploitable remotely over the network, and a public proof-of-concept has been disclosed.

Critical Impact
Remote attackers with low-privilege access can corrupt stack memory on affected Tenda F1202 devices, potentially leading to denial of service or arbitrary code execution on the router.

Affected Products

Tenda F1202 router, firmware 1.2.0.20(408)
Web management interface endpoint /goform/GstDhcpSetSerof
formGstDhcpSetSer request handler function

Discovery Timeline

2026-05-25 - CVE-2026-9430 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9430

Vulnerability Analysis

The vulnerability is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. The formGstDhcpSetSer function processes guest network DHCP server configuration requests sent to /goform/GstDhcpSetSerof. The handler reads the dips parameter from the HTTP request body without validating its length before copying it into a fixed-size stack buffer.

When an attacker supplies a dips value exceeding the destination buffer size, adjacent stack memory is overwritten. This corruption can clobber saved return addresses and function pointers, redirecting control flow. On MIPS-based Tenda firmware, such conditions are commonly leveraged to achieve arbitrary code execution through return-oriented programming.

Root Cause

The root cause is the absence of bounds checking when handling the dips HTTP parameter inside formGstDhcpSetSer. The firmware uses unsafe string-copy semantics that trust attacker-controlled input length. Memory-corrupting primitives like strcpy or sprintf on stack buffers remain common in Tenda's goform web handlers.

Attack Vector

The attack vector is network-based and requires low privileges, typically authenticated access to the router's web management interface. An attacker sends a crafted HTTP POST request to /goform/GstDhcpSetSerof containing an oversized dips value. No user interaction is required. A public exploit is available in the referenced GitHub PoC Repository, increasing the likelihood of opportunistic exploitation against exposed devices.

For exploit specifics, consult the VulDB #365411 advisory rather than synthesized code.

Detection Methods for CVE-2026-9430

Indicators of Compromise

HTTP POST requests targeting /goform/GstDhcpSetSerof containing abnormally long dips parameter values
Unexpected reboots, watchdog resets, or httpd process crashes on Tenda F1202 devices
Outbound connections from the router to unfamiliar hosts following suspicious management requests
Unauthorized changes to guest DHCP server configuration in the device administration panel

Detection Strategies

Inspect web traffic to the router for goform endpoint requests with parameters exceeding expected length thresholds
Correlate management interface authentication events with subsequent crashes or service restarts on the router
Monitor for known PoC signatures published in the GitHub PoC Repository

Monitoring Recommendations

Forward router syslog and web server logs to a centralized log platform for retention and analysis
Alert on repeated POST requests to /goform/GstDhcpSetSerof from a single source within short time windows
Track failed login attempts to the Tenda management UI that precede malformed parameter submissions

How to Mitigate CVE-2026-9430

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal hosts only and disable remote WAN-side administration
Change default and weak administrative credentials to reduce the chance an attacker reaches the authenticated endpoint
Segment the Tenda F1202 from sensitive network zones until a vendor patch is verified
Monitor the Tenda Official Website for firmware updates addressing CVE-2026-9430

Patch Information

As of the last NVD update on 2026-05-26, no vendor patch has been published for Tenda F1202 firmware 1.2.0.20(408). Administrators should track the VulDB #365411 entry and the Tenda Official Website for firmware advisories.

Workarounds

Place the device behind a network firewall that blocks unsolicited inbound HTTP and HTTPS to the management interface
Disable the guest network feature if it is not required, reducing exposure of the GstDhcpSetSerof handler
Replace end-of-support or unpatched SOHO routers with actively maintained hardware where feasible

bash

# Configuration example: restrict management interface access using an upstream firewall
# Allow only the administrative subnet to reach the router web UI
iptables -A FORWARD -s 10.0.0.0/24 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 443 -j DROP