CVE-2026-27511: Tenda F3 Clickjacking in Web Management Interface
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27511?
CVE-2026-27511 is classified as a medium-severity vulnerability due to the potential for exploitation through clickjacking.
How do I fix CVE-2026-27511?
To mitigate CVE-2026-27511, update the Shenzhen Tenda F3 Wireless Router firmware to the latest version that includes the X-Frame-Options header.
What is clickjacking in CVE-2026-27511?
Clickjacking in CVE-2026-27511 refers to a technique where an attacker tricks a user into clicking on an invisible element in a webpage, potentially compromising their authentication.
Who is affected by CVE-2026-27511?
Users of the Shenzhen Tenda F3 Wireless Router running firmware V12.01.01.55_multi are affected by CVE-2026-27511.
What are the risks associated with CVE-2026-27511?
The risks associated with CVE-2026-27511 include unauthorized access and administrative control of the router if the clickjacking exploit is successful.