CVE-2026-27511 - Vulnerability Analysis

Overview

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability caused by missing X-Frame-Options header in the web-based administrative interface, letting attacker-controlled sites trick authenticated administrators into unintended actions.

Severity & Score

Impact

Attackers can trick authenticated administrators into making unauthorized configuration changes via clickjacking.

Mitigation

Update to the latest firmware version that sets proper X-Frame-Options headers.

References

• https://www.tendacn.com/product/F3
• https://www.vulncheck.com/advisories/tenda-f3-clickjacking-in-web-management-interface

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner