PT-2026-21529 · Tenda · Tenda F3 Wireless Router

Kazuma Matsumoto · Published 2026-02-23 · Updated 2026-02-24 · CVE-2026-27511

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda F3 Wireless Router firmware version V12.01.01.55 multi

Description The web-based administrative interface does not set the X-Frame-Options header, which allows an attacker to embed administrative pages in an iframe. This can trick an authenticated administrator into performing unintended actions, potentially leading to unauthorized configuration changes. This is a clickjacking issue.

Recommendations Apply a configuration that sets the X-Frame-Options header to prevent embedding the administrative interface in an iframe.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2026-02454

CVE-2026-27511

Affected Products

Tenda F3 Wireless Router

References · 7

• 🔥 https://vulncheck.com/advisories/tenda-f3-clickjacking-in-web-management-interface · Exploit
• https://osv.dev/vulnerability/CVE-2026-27511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27511 · Security Note
• https://bdu.fstec.ru/vul/2026-02454 · Security Note
• https://t.me/CVEtracker/45508 · Telegram Post
• https://tendacn.com/product/F3 · Note
• https://twitter.com/CVEnew/status/2026265035777909180 · Twitter Post