CVE-2026-27513

Medium
|5.1
No Exploit

Plain English Summary

AI-powered analysis for quick understanding

An attacker can trick an authenticated administrator of the Tenda F3 router into making unwanted changes to the router's settings through its web interface. This vulnerability occurs because the router does not have protections in place to prevent such attacks, meaning the administrator must be logged in for the attack to succeed.

Technical Description

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
Confidentiality ImpactHigh
Integrity ImpactHigh
Availability ImpactHigh
ScopeChanged

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$690($500-$1K)
Vendor Response
Grade APatched in 0 days

Quick Information

Published

Feb 23, 2026

about 1 month ago

Last Modified

Feb 23, 2026

about 1 month ago

Vendor

tenda

Product

f3 firmware

Related Vulnerabilities

CVE-2026-3811High

An attacker can remotely exploit a vulnerability in Tenda FH1202 routers to execute arbitrary code by sending specially crafted data to a specific function, which can lead to a crash or unauthorized control of the device. This attack requires no physical access and can be carried out over the internet, making it a significant risk for users with this firmware version.

CVE-2026-3810High

This vulnerability allows an attacker to remotely take control of the Tenda FH1202 router by exploiting a flaw in its DHCP client list function, which can lead to a crash or unauthorized access to the device. The attacker needs to send specially crafted data to the router, making it possible for them to execute harmful code on the device.

CVE-2026-3809High

An attacker can remotely exploit a flaw in the Tenda FH1202 router's firmware to execute arbitrary code by manipulating a specific setting, potentially taking control of the device. This vulnerability requires no special access, making it easy for attackers to target affected routers over the internet.

CVE-2026-3808High

This vulnerability allows an attacker to remotely execute malicious code on the Tenda FH1202 router by exploiting a flaw in how the device handles certain input data. The attacker needs to manipulate a specific argument in the router's web interface, which could lead to unauthorized access or control of the device.

CVE-2026-3807High

An attacker can remotely exploit a vulnerability in the Tenda FH1202 router to execute arbitrary code by sending specially crafted data that causes a buffer overflow, potentially taking control of the device. This attack can happen without needing physical access, making it a serious risk for users of this router firmware version.