Session Hijacking Vulnerability in Tenda Wireless Routers
CVE-2026-22082

8.8HIGH

Key Information:

Vendor

Tenda
Status
300mbps Wireless Router F3 And N300 Easy Setup Router
Vendor
CVE Published:
9 January 2026

What is CVE-2026-22082?

A security issue has been identified in Tenda wireless routers, specifically in the 300Mbps Wireless Router F3 and N300 Easy Setup Router. This vulnerability arises from the use of login credentials as the session ID within the web-based administrative interface. A remote attacker can exploit this flaw by intercepting network traffic, allowing them to capture the session ID during its transmission if it occurs over an unsecured network. The successful exploitation enables an attacker to hijack an authenticated session, potentially compromising sensitive configuration details and gaining unauthorized access to the device's management functionalities.

Affected Version(s)

300Mbps Wireless Router F3 and N300 Easy Setup Router F3 v3.0 Firmware V12.01.01.41

300Mbps Wireless Router F3 and N300 Easy Setup Router F3 v3.0 Firmware V12.01.01.42

300Mbps Wireless Router F3 and N300 Easy Setup Router F3 v3.0 Firmware V12.01.01.48

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Deven Lunkad, Swaroop Dora, Naziya Aslam, and S. Venkatesan from IoT Security Research Lab, Indian Institute of Information Technology, Allahabad, India.
.