CVE-2026-27514 describes a sensitive information exposure vulnerability in the Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi. The issue occurs in the configuration download functionality, where the response includes plaintext router and administrative passwords. The absence of Cache-Control directives in the HTTP response allows the sensitive data to be stored in client-side caches, increasing the risk of unauthorized local access. The vulnerability is categorized under CWE-201 (Exposure of Sensitive Information Through Sent Data) and CWE-525 (Use of Web Browser Cache Containing Sensitive Information). The CVSS v4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, and no privileges or user interaction required.

An attacker with local access to the client device or browser cache could retrieve sensitive router credentials from cached configuration download responses. This exposure could lead to unauthorized administrative access to the router, compromising network security. The vulnerability does not require user interaction or elevated privileges to exploit, increasing its risk. There are no known exploits in the wild at this time.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should avoid downloading or storing router configuration files on shared or untrusted devices. Clearing browser caches after configuration downloads may reduce risk. Monitor vendor communications for updates on patches or firmware upgrades addressing this issue.