Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router use the user’s login credentials as the session ID for their web‑based administrative interface. Because the session ID is transmitted without encryption, an attacker on the same network can eavesdrop on traffic and capture the ID. The vulnerability is described as a CWE‑384, representing unauthorized use of credentials. Once the attacker has the session ID, they can hijack the authenticated session and read or modify sensitive configuration settings on the device.

The affected products are the Tenda 300Mbps Wireless Router F3 and the N300 Easy Setup Router. No specific firmware or model version information is listed in the advisory.

The CVSS v3 score of 8.8 marks the issue as high severity. The EPSS score of less than 1 % indicates a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, requiring network visibility to intercept traffic, so an attacker on the local network or with compromised devices can exploit it by simple packet sniffing. The combination of a severe impact and a very low exploit probability means the overall risk is moderate, but the potential damage to configuration confidentiality and integrity warrants timely remediation.