CVE-2026-7035
Stack-Based Buffer Overflow in Tenda FH1202 HTTPD Allows Remote Exploit
Publication date: 2026-04-26
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | fh1202_firmware | 1.2.0.14(408) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-7035 vulnerability affects the Tenda FH1202 router, version 1.2.0.14. It is a stack-based buffer overflow found in the HTTP daemon (httpd) within the function formWrlclientSet.
Specifically, the function reads a user-supplied parameter named "GO" and stores it in a variable which is then passed to another function without any length validation. Inside that function, the parameter is copied into a fixed-size stack buffer using sprintf without bounds checking, leading to a potential overflow.
An attacker can send a specially crafted POST request to the /goform/WrlclientSet endpoint with an excessively long "GO" parameter, causing the buffer overflow.
This flaw can be exploited to cause denial of service (DoS) or remote code execution (RCE) on the device.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to denial of service (DoS), making the device unavailable or unstable.
More critically, it can allow remote code execution (RCE), enabling an attacker to run arbitrary code on the affected device remotely.
This could compromise the security and integrity of the device and potentially the network it is connected to.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a specially crafted POST request to the /goform/WrlclientSet endpoint of the Tenda FH1202 router, version 1.2.0.14, with an excessively long "GO" parameter. The presence of the vulnerability is indicated if the device crashes, becomes unresponsive, or exhibits abnormal behavior due to the stack-based buffer overflow.
A detection command example using curl would be:
- curl -X POST http://[router_ip]/goform/WrlclientSet -d "GO=$(python3 -c 'print("a"*1000)')"
This command sends a POST request with a very large "GO" parameter consisting of repeated 'a' characters to trigger the overflow and test if the device is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict access to the router's management interface, especially the /goform/WrlclientSet endpoint, by limiting it to trusted networks or IP addresses.
- Disable remote management if it is enabled to prevent remote exploitation.
- Monitor network traffic for suspicious POST requests targeting the /goform/WrlclientSet endpoint with unusually large "GO" parameters.
- Apply any available firmware updates or patches from the vendor that address this vulnerability.
If no patch is available, consider replacing or isolating the affected device to reduce risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-7035 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.