CVE-2026-22081

Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers

State: Published
Severity: 8.8 High
Published: Jan 9, 2026
Updated: Jan 9, 2026
Reserved: Jan 6, 2026

Description

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote at-tacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection.

Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unau-thorized access to the targeted device.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	CERT-In

Weaknesses

CWE-1004 Sensitive Cookie Without HttpOnly Flag

Affected Products

Product	Versions
300Mbps Wireless Router F3 and N300 Easy Setup RouterTenda	F3 v3.0 Firmware V12.01.01.41Affected F3 v3.0 Firmware V12.01.01.42Affected F3 v3.0 Firmware V12.01.01.48Affected F3 v3.0 Firmware V12.01.01.52Affected F3 v3.0 Firmware V12.01.01.55Affected F3 v4.0 Firmware V03.03.01.40Affected

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0004third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.