The vulnerability CVE-2026-27512 affects Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi. It is a content-type confusion issue where the administrative interface responses lack the X-Content-Type-Options: nosniff header. This omission allows browsers to perform MIME sniffing on responses containing attacker-influenced content reflected in the response body. Under certain browser behaviors, this can result in the response being treated as active HTML, enabling cross-site scripting (XSS) attacks. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-116 (Improper Encoding or Escaping of Output).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the router's administrative interface. This could lead to unauthorized actions or disclosure of sensitive information within the administrative session. However, the CVSS score of 5.1 and the medium severity rating indicate a moderate impact. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should limit access to the administrative interface to trusted networks and users only, and avoid interacting with suspicious content that could exploit this vulnerability.