The vulnerability CVE-2026-27512 in the Tenda F3 router firmware arises from improper neutralization of input during web page generation (CWE-79) combined with content-type confusion (CWE-116). The administrative interface responses lack the X-Content-Type-Options: nosniff header, allowing browsers to MIME-sniff the content. Because attacker-influenced content is reflected in the response body, this can result in cross-site scripting (XSS) where scripts execute in the context of the administrative interface, potentially compromising the router's web management interface.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the router's administrative interface, potentially leading to unauthorized actions or information disclosure through the web management interface. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited scope and impact on confidentiality and integrity.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when accessing the administrative interface and avoid interacting with untrusted content or links that could trigger the vulnerability.