Security readout for executives and security teams
Plain-English summary
CVE-2026-22081 affects specific Tenda F3 and N300 router firmware. The router admin interface sets session cookies without the HttpOnly flag, and the advisory says attackers could capture cookies over insecure HTTP. If successful, an attacker could access the device as an authenticated administrator.
Executive priority
Treat as a high-priority network device exposure. Compromise of small routers can disrupt connectivity, weaken perimeter controls, or enable unauthorized configuration changes. Prioritize internet-facing or branch-office devices first.
Technical view
The issue is CWE-1004: session cookies for the web-based administrative interface lack the HttpOnly attribute. CERT-IN/CVE describe remote exploitation via session cookie capture over insecure HTTP, leading to sensitive information exposure and unauthorized device access. CVSS v4.0 score is 8.8 High.
Likely exposure
Exposure is limited to the listed Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router firmware versions. Organizations are most exposed where router administration is reachable over untrusted networks or performed over plain HTTP.
Exploitation context
No source provided evidence of active exploitation, and this CVE is not marked KEV. The described attack depends on obtaining an administrator session cookie from insecure HTTP traffic, then using it to access the targeted device.
Researcher notes
The public sources do not name a fixed firmware version. The CVSS vector lists network, low complexity, no privileges, and no user interaction. The advisory text ties exploitation to insecure HTTP cookie capture, so validate both cookie attributes and management-plane exposure.
Mitigation direction
- Check Tenda and CERT-IN guidance for fixed firmware or official workarounds.
- Upgrade affected firmware if a vendor-supported fixed version is available.
- Restrict router administration to trusted management networks only.
- Disable internet-facing remote administration where possible.
- Avoid using the admin interface over insecure or untrusted networks.
- Rotate admin credentials and sessions after remediation.
Validation and detection
- Inventory Tenda F3 and N300 devices and record firmware versions.
- Compare firmware against the affected versions listed in the advisory.
- Inspect admin interface Set-Cookie headers for the HttpOnly attribute.
- Confirm the admin interface is not exposed to the internet.
- Review router logs for unexpected administrative access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1004: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22081 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0004CVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Sensitive Cookie Without 'HttpOnly' Flag
Sensitive Cookie Without 'HttpOnly' Flag represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.