CVE-2026-3810
Stack-Based Buffer Overflow in Tenda FH1202 DHCP Client Allows Remote Exploitation
Publication date: 2026-03-09
Last updated on: 2026-03-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | fh1202_firmware | 1.2.0.14(408) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3810 is a stack-based buffer overflow vulnerability found in the Tenda FH1202 router firmware version 1.2.0.14(408). It exists in the HTTP daemon component, specifically in the fromDhcpListClient function that handles requests to the /goform/DhcpListClient endpoint.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the function copies the user-supplied "page" parameter into a fixed-size stack buffer using the sprintf function without checking the length of the input. If an attacker sends an excessively long "page" parameter, it causes a stack buffer overflow.'}, {'type': 'paragraph', 'content': 'This overflow can lead to denial of service (DoS) or potentially allow remote code execution (RCE) on the affected device.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploiting this vulnerability can allow an attacker to remotely cause a denial of service (DoS) on the Tenda FH1202 router, making the device unavailable.
More severely, the attacker may achieve remote code execution (RCE), which means they could run arbitrary code on the router, potentially taking full control of the device.
This compromises the confidentiality, integrity, and availability of the router and any network traffic passing through it.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests sent to the /goform/DhcpListClient endpoint on the Tenda FH1202 router. Specifically, detection involves identifying requests that include an excessively long "page" parameter, which triggers the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze network traffic targeting the router\'s HTTP daemon for suspiciously long "page" parameter values.'}, {'type': 'list_item', 'content': 'Use network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to /goform/DhcpListClient.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <router_ip>) and (tcp[((tcp[12] & 0xf0) >> 2):4] = 0x504f5354)))'"}, {'type': 'list_item', 'content': 'Inspect captured HTTP POST data for the "page" parameter length. Excessively long values may indicate exploitation attempts.'}, {'type': 'list_item', 'content': 'Alternatively, use web application firewall (WAF) rules or intrusion detection systems (IDS) to alert on unusually long "page" parameters in HTTP requests to /goform/DhcpListClient.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'No known mitigations or patches are currently available for this vulnerability.'}, {'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the affected Tenda FH1202 router's HTTP management interface from untrusted networks to prevent remote exploitation."}, {'type': 'paragraph', 'content': 'It is recommended to replace the affected device with an alternative product that is not vulnerable to this issue.'}, {'type': 'paragraph', 'content': 'Monitoring network traffic for exploitation attempts and disabling remote management features if possible can also reduce risk.'}] [3]