CVE-2026-27511

MEDIUM

4.3

Descricao

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.

Detalhes CVE

Pontuacao CVSS v3.14.3

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado2/23/2026

Ultima modificacao2/23/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

tenda:f3tenda:f3_firmware

Fraquezas (CWE)

CWE-1021

Referencias

https://www.tendacn.com/product/F3(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/tenda-f3-clickjacking-in-web-management-interface(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.