Tenda Wireless Routers vulnerabilities

Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) use login credentials as the session ID in the web-based administrative interface. A remote attacker can intercept network traffic and capture the session ID during insecure transmission.

Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) lack the HTTPOnly flag for session cookies in the web-based administrative interface. A remote attacker can capture session cookies transmitted over an insecure HTTP connection.

Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) transmit login credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network can intercept traffic and capture the encoded credentials.

Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) transmit login credentials in plaintext during initial login or post-factory reset setup through the web-based administrative interface. An attacker on the same network can intercept traffic and capture the credentials.