Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in its web‑based management interface. The interface fails to set the X‑Frame‑Options response header, allowing a malicious website to embed the router’s administrative pages inside an iframe. An authenticated administrator who visits the malicious site could be tricked into clicking on interface controls, potentially resulting in unauthorized configuration changes.

Shenzhen Tenda Technology Co., Ltd. offers the Tenda F3 wireless router. The vulnerability applies to the F3 firmware version V12.01.01.55_multi; no other versions are explicitly mentioned.

CVSS explains a medium severity of 5.1. The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker only needs to host a webpage that embeds the router’s administrative interface; the attack requires the victim to be authenticated to the router, so it is limited to administrators who already have access credentials. If the router’s interface is exposed externally or if route management is accessible without network isolation, the risk increases.