Tenda F3 Wireless Router Can Be Tricked into Unwanted Configuration Changes

Summary

A security weakness in the Tenda F3 Wireless Router's web interface allows an attacker to trick an administrator into making unintended changes to the router's settings. This could lead to unauthorized access or changes to the network. The router's manufacturer should be contacted to obtain a patched version.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	f3_firmware	<= 12.01.01.55_multi	–

Original title

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header,...

Original description

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.

nvd CVSS3.1 4.3

nvd CVSS4.0 5.1

Vulnerability type

CWE-1021

https://www.tendacn.com/product/F3 Product
https://www.vulncheck.com/advisories/tenda-f3-clickjacking-in-web-management-int... Exploit Third Party Advisory