The Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router transmit administrative credentials using reversible Base64 encoding over the web interface. Decoding the captured data allows an attacker to read the username and password, providing direct access to the device's configuration and potentially the network. This flaw leads to compromising confidentiality of credentials and enables unauthorized administrative control of the router.

Vulnerable models include the Tenda 300Mbps Wireless Router F3 and the N300 Easy Setup Router, which are distributed globally for home and small office use. No specific firmware revision is listed, indicating that all releases of these models are affected unless a later firmware addresses the issue. The vulnerability applies regardless of the wireless standards used, affecting devices that rely on the web‑based admin portal.

The flaw carries a CVSS v3.1 score of 8.7, classifying it as high severity. Exploit likelihood is low based on an EPSS score below 1%; however, devices are typically local to a network segment, making the attack vector local and the attacker capable of sniffing traffic with relative ease. The vulnerability is not yet represented in the CISA KEV catalog, but the available analysis indicates that an active Windows or Linux machine on the same network can capture the Base64 stream, decode it and immediately log into the router’s administrative console.