Tenda W30E V2 Missing X-Content-Type-Options Header Vulnerability

A vulnerability exists in the Shenzhen Tenda W30E V2 router, specifically in firmware versions up to and including V16.01.0.19(5037). The issue arises because the web management interface does not include the X-Content-Type-Options: nosniff response header. This omission can lead to browsers that perform MIME sniffing to mistakenly interpret responses influenced by an attacker as executable scripts.

Impact

The lack of the X-Content-Type-Options header can result in improper handling of content types by the browser, potentially allowing for the execution of malicious scripts.