What is the CVSS score of CVE-2026-27513?

CVE-2026-27513 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of F3 Firmware are affected by CVE-2026-27513?

Organizations using Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi should be aware of moderate risk from CVE-2026-27513, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-27513?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

F3 Firmware CVE-2026-27513

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-02-23 disclosure@vulncheck.com

CSRF Tenda F3 Firmware

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 17:23 nvd

MEDIUM 4.3

DescriptionCVE.org

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.

AnalysisAI

The Tenda F3 Wireless Router firmware lacks CSRF protections in its administrative interface, enabling attackers to trick authenticated administrators into making unauthorized configuration changes through crafted requests. An unauthenticated attacker can exploit this to modify router settings by socially engineering an admin into visiting a malicious webpage. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects the web-based administrative component of F3 Firmware. Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.