CVE-2026-27512mediumCWE-116CWE-79

CVE-2026-27512: medium-severity vulnerability in Shenzhen Tenda Technology Co., Ltd. Tenda F3

Tenda F3 Reflected Script Execution via Missing nosniff Header

Published · Updated

Follow this CVE+ Monitor Tenda F3

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Shenzhen Tenda Technology Co., Ltd. · Tenda F3
Related CVEs — Shenzhen Tenda Technology Co., Ltd. Tenda F3

In the same product, most dangerous first.

CVE-2026-27514HIGHTenda F3 Plaintext Credential Exposure in Configuration DownloadEPSS 0.3%CVE-2026-27511MEDIUMTenda F3 Clickjacking in Web Management InterfaceEPSS 0.2%CVE-2026-27513MEDIUMTenda F3 CSRF in Web Management InterfaceEPSS 0.1%