CVE-2026-27512

MEDIUM

6.1

Descricao

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.

Detalhes CVE

Pontuacao CVSS v3.16.1

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado2/23/2026

Ultima modificacao2/23/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

tenda:f3tenda:f3_firmware

Fraquezas (CWE)

CWE-79CWE-116

Referencias

https://www.tendacn.com/product/F3(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/tenda-f3-reflected-script-execution-via-missing-nosniff-header(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.