CVE-2026-22080
Last modified
CVE-2026-22080 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the Base64-encoded credentials. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the Base64-encoded credentials. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.
Metrics
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-22080?
How severe is CVE-2026-22080?
How do I fix CVE-2026-22080?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2207A weakness has been identified in WeKan up to 8.20. This iss…6.9
- CVE-2026-22070ColorOS Assistant has an unauthenticated start-download chan…9.8
- CVE-2026-22077OPPO Wallet APP contains a trusted domain validation flaw th…5.6
- CVE-2026-22078Because O+ Connect's IPC service does not authenticate clien…7.3
- CVE-2026-22079This vulnerability exists in Tenda wireless routers (300Mbps…8.7
- CVE-2026-2208A security vulnerability has been detected in WeKan up to 8.…6.5
- CVE-2026-22081This vulnerability exists in Tenda wireless routers (300Mbps…8.8
- CVE-2026-22082This vulnerability exists in Tenda wireless routers (300Mbps…8.8
- CVE-2026-2209A vulnerability was detected in WeKan up to 8.18. The affect…4.3
- CVE-2026-22093The EVbee Service Android app uses TLS encrypted communicati…9.5
- CVE-2026-22095The network diagnosis endpoint on the web server at port 809…9.3
- CVE-2026-22096The webserver running on port 8090 does not require authenti…9.3
Are you affected by CVE-2026-22080?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST