Vulnerability

CERT-In Vulnerability Note CIVN-2026-0004
Multiple Vulnerabilities in Tenda Wireless Router

Original Issue Date:January 08, 2026

Severity Rating: HIGH

Systems Affected

Tenda 300Mbps Wireless Router F3 and the Tenda N300 Easy Setup Router

F3 v3.0 Firmware V12.01.01.41
F3 v3.0 Firmware V12.01.01.42
F3 v3.0 Firmware V12.01.01.48
F3 v3.0 Firmware V12.01.01.52
F3 v3.0 Firmware V12.01.01.55
F3 v4.0 Firmware V03.03.01.40

Overview

Multiple vulnerabilities have been reported in Tenda wireless routers, which could allow an attacker to obtain sensitive information and gain unauthorized access to the targeted device.

Target Audience:
End-users/ Administrators of Tenda wireless router

Risk Assessment:
Risk of exposure of credentials and router configuration settings.

Impact Assessment:
Impact on confidentiality and integrity of the vulnerable device.

Description

The Tenda 300Mbps Wireless Router F3 and the Tenda N300 Easy Setup Router are basic home/office Wi-Fi routers that support the 802.11n (Wi-Fi 4) standard and operate at wireless speeds of up to 300 Mbps on the 2.4 GHz band.

1. Cleartext Transmission Vulnerability ( CVE-2026-22079   )

This vulnerability exists in Tenda wireless routers due to the plaintext transmission of login credentials during the initial login or post-factory reset setup through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the credentials transmitted in plaintext.

Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.

2. Insecure Transmission Vulnerability ( CVE-2026-22080   )

This vulnerability exists in Tenda wireless routers due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the Base64-encoded credentials.

Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.

3. Cookie without HTTPOnly Flag Vulnerability ( CVE-2026-22081   )

This vulnerability exists in Tenda wireless routers due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote attacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection.

Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.

4. Insecure Session ID Management Vulnerability ( CVE-2026-22082   )

This vulnerability exists in Tenda wireless routers due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and capturing the session ID during insecure transmission.

Successful exploitation of this vulnerability could allow the attacker to hijack an authenticated session and compromise sensitive configuration information on the targeted device.

Credit

These vulnerabilities are reported by Deven Lunkad, Swaroop Dora, Naziya Aslam, and S. Venkatesan from IoT Security Research Lab, Indian Institute of Information Technology, Allahabad, India.

Solution

Apply appropriate updates as mentioned by the vendor:
https://www.tendacn.com/in/material/show/724624313163845

Vendor Information

Tenda India
https://www.tendacn.com/in/material/show/724624313163845

References

Tenda India
https://www.tendacn.com/in/material/show/724624313163845

CVE Name
CVE-2026-22079
CVE-2026-22080
CVE-2026-22081
CVE-2026-22082

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India