The Tenda F3 Wireless Router firmware V12.01.01.55_multi lacks anti‑CSRF protections in its web‑based administrative interface, allowing an attacker to trick an authenticated administrator into submitting state‑changing requests. The resulting unauthorized configuration changes can alter router settings, potentially exposing the network to further attacks or disrupting service. This vulnerability is identified as CWE‑352.

Shenzhen Tenda Technology’s Tenda F3 wireless router, firmware version 12.01.01.55_multi. No other firmware versions are listed in the advisory but the issue may affect any version lacking the patch that implements CSRF protection.

With a CVSS score of 5.1, the vulnerability carries a moderate risk. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the current market. It is not included in the CISA Known Exploited Vulnerabilities catalog. The attack vector relies on a CSRF scenario against a logged‑in administrator, meaning the attacker must persuade a legitimate admin to visit a crafted page or send them a malicious link. The lack of anti‑CSRF safeguards makes this exploitation straightforward for those who can reach the admin session.