CVE-2026-27512: Tenda f3 Firmware

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.

Affected products

• Tenda f3 Firmware: up to and including 12.01.01.55_multi

Published 2026-02-23. Last modified 2026-06-17.