Details of VAR-202603-5079

ID

VAR-202603-5079

CVE

CVE-2026-5046

TITLE

Shenzhen Tenda Technology Co.,Ltd. of fh1201 Multiple vulnerabilities in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2026-009434

DESCRIPTION

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The exploit has been exposed and is at risk of being exploited.All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-5046 // JVNDB: JVNDB-2026-009434

AFFECTED PRODUCTS

vendor:	tenda	model:	fh1201	scope:	eq	version:	1.2.0.14\(408\)	Trust: 1.0
vendor:	tenda	model:	fh1201	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1201	scope:	eq	version:	fh1201 firmware 1.2.0.14¥(408¥)	Trust: 0.8
vendor:	tenda	model:	fh1201	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2026-009434 // NVD: CVE-2026-5046

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2026-5046
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2026-009434
value:	HIGH
Trust: 0.8

cna@vuldb.com:	CVE-2026-5046
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2026-009434
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2026-5046
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2026-009434
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-009434 // NVD: CVE-2026-5046

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	CWE-119	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-009434 // NVD: CVE-2026-5046

PATCH

title:

//vuldb.com/vuln/353969/cti

url:

https://github.com/Litengzheng/vul_db/blob/main/FH1201/vul_44/README.md

Trust: 0.8

sources: JVNDB: JVNDB-2026-009434

EXTERNAL IDS

db:	NVD	id:	CVE-2026-5046	Trust: 2.6
db:	JVNDB	id:	JVNDB-2026-009434	Trust: 0.8

sources: JVNDB: JVNDB-2026-009434 // NVD: CVE-2026-5046

REFERENCES

url:	https://www.tenda.com.cn/	Trust: 1.8
url:	https://vuldb.com/vuln/353969	Trust: 1.0
url:	https://vuldb.com/submit/779127	Trust: 1.0
url:	https://vuldb.com/vuln/353969/cti	Trust: 1.0
url:	https://github.com/litengzheng/vul_db/blob/main/fh1201/vul_44/readme.md	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-5046	Trust: 0.8

sources: JVNDB: JVNDB-2026-009434 // NVD: CVE-2026-5046

SOURCES

db:	JVNDB	id:	JVNDB-2026-009434
db:	NVD	id:	CVE-2026-5046

LAST UPDATE DATE

2026-04-03T23:49:23.294000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-009434	date:	2026-04-01T02:28:00
db:	NVD	id:	CVE-2026-5046	date:	2026-03-30T15:46:16.660

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-009434	date:	2026-04-01T00:00:00
db:	NVD	id:	CVE-2026-5046	date:	2026-03-29T15:16:36.990