Vulnerability · Published Feb 23, 2026 · Assigned by VulnCheck
CVE-2026-27512Tenda F3 Reflected Script Execution via Missing nosniff Header
Medium 6.1
In plain English
A medium-severity cross-site scripting in Tenda F3 from Shenzhen Tenda Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Tenda Technology Co., Ltd. | Tenda F3 | 0 – through 12.01.01.55_multi |
Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N