CVE-2026-27511: Tenda F3 Clickjacking in Web Management Interface

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-23 · updated 2026-06-17
Weakness: CWE-1021

Description

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.

Affected products

Shenzhen Tenda Technology Co., Ltd. Tenda F3: through 12.01.01.55_multi

References

https://www.tendacn.com/product/F3
https://www.vulncheck.com/advisories/tenda-f3-clickjacking-in-web-management-interface

Get alerted when CVE-2026-27511 or the next vulnerability affects your stack