CVE-2026-22080
HighSummary
Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) transmit login credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network can intercept traffic and capture the encoded credentials.
Risk Assessment
Capturing credentials could allow an attacker to obtain sensitive information and gain unauthorized access to the device.
Recommendation
Secure credential transmission (e.g., via HTTPS) and avoid sending data in Base64 without encryption.
Other vulnerabilities in Tenda Wireless Routers
See all- CVE-2026-22082High
Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) use login credentials as the session ID in the web-based administrative interface. A remote attacker can intercept network traffic and capture the session ID during insecure transmission.
- CVE-2026-22081High
Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) lack the HTTPOnly flag for session cookies in the web-based administrative interface. A remote attacker can capture session cookies transmitted over an insecure HTTP connection.
- CVE-2026-22079High
Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) transmit login credentials in plaintext during initial login or post-factory reset setup through the web-based administrative interface. An attacker on the same network can intercept traffic and capture the credentials.
Original NVD description (English source)
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the Base64-encoded credentials. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.