PT-2026-2150 · Tenda · Tenda N300 Easy Setup Router+1

Published 2026-01-09 · Updated 2026-01-09 · CVE-2026-22082

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tenda 300Mbps Wireless Router F3 Tenda N300 Easy Setup Router

Description The routers are susceptible to a flaw stemming from the use of login credentials as the session ID via the web-based administrative interface. A remote attacker could exploit this by intercepting network traffic and capturing the session ID during insecure transmission. Successful exploitation may allow an attacker to hijack an authenticated session and compromise sensitive configuration information on the targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2026-01037

CVE-2026-22082

Affected Products

Tenda 300Mbps Wireless Router F3

Tenda N300 Easy Setup Router

References · 6

• https://bdu.fstec.ru/vul/2026-01037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22082 · Security Note
• https://t.me/CVEtracker/41843 · Telegram Post
• https://github.com/advisories/GHSA-m6m8-c4cv-c66j · Note
• https://twitter.com/CVEnew/status/2009593987280281625 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0004 · Note