PT-2026-2149 · Tenda · Tenda N300 Easy Setup Router+1

Cert-In · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2026-22081

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tenda 300Mbps Wireless Router F3 Tenda N300 Easy Setup Router

Description The routers are susceptible to a security issue stemming from the absence of the HTTPOnly flag on session cookies used with the web-based administrative interface. An attacker positioned remotely could potentially capture these session cookies when they are transmitted over an unencrypted HTTP connection. Successful exploitation may lead to unauthorized access to the device and the potential disclosure of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-1004

Identificadores relacionados

CVE-2026-22081

Produtos afetados

Tenda 300Mbps Wireless Router F3

Tenda N300 Easy Setup Router

Referências · 4

• https://t.me/CVEtracker/41842 · Publicação no Telegram
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0004 · Nota
• https://twitter.com/CVEnew/status/2009593988307992897 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22081 · Nota de Segurança