Tenda f3 Firmware vulnerabilities

10 CVEs affecting Tenda f3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-27514, published 2026-02-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-35391, published 2021-01-01. Medium severity, CVSS 6.5. EPSS: 35.2% chance of exploitation in the next 30 days. Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related…
CVE-2026-27514, published 2026-02-23. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response…
CVE-2026-27512, published 2026-02-23. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff…
CVE-2026-27511, published 2026-02-23. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header,…
CVE-2025-57573, published 2025-09-10. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi.
CVE-2025-57572, published 2025-09-10. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl.
CVE-2025-57571, published 2025-09-10. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList parameter in goform/setNAT.
CVE-2025-57570, published 2025-09-10. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS.
CVE-2025-57569, published 2025-09-10. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT.
CVE-2026-27513, published 2026-02-23. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement…