Sensitive Information Exposure in Tenda F3 Wireless Router Firmware
CVE-2026-27514

7.1HIGH

Key Information:

Vendor

Shenzhen Tenda Technology Co., Ltd.

Status
Tenda F3
Vendor
CVE Published:
23 February 2026

What is CVE-2026-27514?

The Tenda F3 Wireless Router's firmware version V12.01.01.55_multi reveals sensitive information through its configuration download feature. This vulnerability allows the router's administrative and user passwords to be transmitted in plaintext, potentially exposing them to unauthorized local users or processes. Furthermore, inadequate Cache-Control directives enable the response to be stored in client-side caches, increasing the risk of password retrieval from cached data. Users are advised to secure their routers and monitor firmware updates to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tenda F3 0 <= 12.01.01.55_multi

References

https://www.tendacn.com/product/F3
product
https://www.vulncheck.com/advisories/tenda-f3-plaintext-c...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
JSON
.