CyberSecBulletin
CVE-2026-22081NVD status: Deferred

300Mbps Wireless Router F3 and N300 Easy Setup…: Sensitive Cookie Without 'HttpOnly' Flag

Published Updated By the CyberSecBulletin desk

CVE-2026-22081 is a high-severity sensitive cookie without 'httponly' flag vulnerability in 300Mbps Wireless Router F3 and N300 Easy Setup Router from Tenda, with a CVSS 4.0 base score of 8.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected 300Mbps Wireless Router F3 and N300 Easy Setup Router versions: F3 v3.0 Firmware V12.01.01.41; F3 v3.0 Firmware V12.01.01.42; F3 v3.0 Firmware V12.01.01.48, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.38% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of 300Mbps Wireless Router F3 and N300 Easy Setup Router you run against the affected versions below, and install the vendor's latest release.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Tenda300Mbps Wireless Router F3 and N300 Easy Setup RouterF3 v3.0 Firmware V12.01.01.41; F3 v3.0 Firmware V12.01.01.42; F3 v3.0 Firmware V12.01.01.48; F3 v3.0 Firmware V12.01.01.52; F3 v3.0 Firmware V12.01.01.55; F3 v4.0 Firmware V03.03.01.40Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Attack requirements
NoneThe attack does not depend on a particular deployment or configuration.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Confidentiality (vulnerable system)
HighSerious loss of confidentiality on the vulnerable system.
Integrity (vulnerable system)
LowLimited loss of integrity on the vulnerable system.
Availability (vulnerable system)
LowLimited loss of availability on the vulnerable system.
Confidentiality (other systems)
NoneNo loss of confidentiality on systems beyond the vulnerable one.
Integrity (other systems)
NoneNo loss of integrity on systems beyond the vulnerable one.
Availability (other systems)
NoneNo loss of availability on systems beyond the vulnerable one.

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (cert-in.org.in).

Official description

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote at-tacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unau-thorized access to the targeted device.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

How developers prevent this class of flaw

  • Leverage the HttpOnly flag when setting a sensitive cookie in a response.

More Sensitive Cookie Without 'HttpOnly' Flag vulnerabilities (CWE-1004)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in 300Mbps Wireless Router F3 and N300 Easy Setup Router

All 300Mbps Wireless Router F3 and N300 Easy Setup Router vulnerabilities

Recent Sensitive Cookie Without 'HttpOnly' Flag vulnerabilities

Spotted an error? Tell us.