Security readout for executives and security teams
Plain-English summary
This vulnerability lets an attacker trick a logged-in Tenda F3 router administrator into making unwanted configuration changes through the web management interface. The issue is not described as device takeover, but router configuration tampering can still affect network reliability, security settings, or remote access posture.
Executive priority
Treat this as a moderate operational risk for sites using Tenda F3 routers. Prioritize inventory, management-interface restriction, and vendor update checks. Escalate if these routers protect sensitive offices, remote sites, or networks without central configuration monitoring.
Technical view
CVE-2026-27513 is a CWE-352 cross-site request forgery issue in the Tenda F3 web administrative interface, reported for firmware V12.01.01.55_multi. The interface lacks anti-CSRF protections for state-changing requests. CVSS v4.0 is 5.1 medium, with active user interaction required.
Likely exposure
Exposure is likely limited to environments using Tenda F3 routers on the affected firmware and administrators who use the web management interface. Risk increases when the admin interface is reachable from less-trusted networks or admins browse untrusted sites while authenticated.
Exploitation context
The source bundle does not identify active exploitation, and KEV is false. Exploitation depends on inducing an authenticated administrator to submit unintended state-changing requests. The provided sources do not name a public exploit, patch, or confirmed vendor remediation.
Researcher notes
Evidence is concise and points to missing CSRF protections in the web admin interface. The affected version information is strongest in the description, while the affected-version field appears incomplete. No patch status, exploit status, or detailed endpoint scope is provided in the bundle.
Mitigation direction
- Check Tenda guidance for firmware updates or official remediation.
- Inventory Tenda F3 routers and confirm firmware versions.
- Restrict web management access to trusted admin networks.
- Disable remote administration where it is not required.
- Require administrators to log out after router management sessions.
- Avoid browsing untrusted sites while authenticated to router administration.
Validation and detection
- Confirm whether Tenda F3 devices are present in the environment.
- Record firmware versions, especially V12.01.01.55_multi.
- Review whether the web management interface is remotely reachable.
- Check router configuration change logs for unexpected modifications.
- Track CVE, Tenda, and VulnCheck pages for remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27513 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.tendacn.com/product/F3CVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/tenda-f3-csrf-in-web-management-interfaceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.