Shenzhen Tenda Technology Co., Ltd. Tenda F3 vulnerabilities
4 vulnerabilities
Known vulnerabilities in Shenzhen Tenda Technology Co., Ltd. Tenda F3, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-27512shenzhen tenda technology co., ltd. · tenda f3 +1 moreTenda F3 Reflected Script Execution via Missing nosniff HeaderShenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.EPSS0.37%MediumCVE-2026-27511shenzhen tenda technology co., ltd. · tenda f3 +1 moreTenda F3 Clickjacking in Web Management InterfaceShenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.EPSS0.37%MediumCVE-2026-27513shenzhen tenda technology co., ltd. · tenda f3 +1 moreTenda F3 CSRF in Web Management InterfaceShenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.EPSS0.18%HighCVE-2026-27514shenzhen tenda technology co., ltd. · tenda f3 +1 moreTenda F3 Plaintext Credential Exposure in Configuration DownloadShenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.EPSS0.43%