CVE-2026-27514

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Insertion of Sensitive Information Into Sent Data pada tenda f3 firmware. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.

Rincian

Terbit di NVD

23 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-525: Use of Web Browser Cache Containing Sensitive Information

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/tenda-f3-plaintext-credential-exposure-in-configuration-download advisory pihak ketiga
• https://www.tendacn.com/product/F3 product