Tenda F3 Wireless Router Content-Type Confusion Vulnerability Allowing Reflected Cross-Site Scripting

A content-type confusion vulnerability has been identified in the administrative interface of the Tenda F3 Wireless Router, specifically in firmware version 12.01.01.55_multi. This vulnerability arises because the response headers omit the X-Content-Type-Options: nosniff directive, allowing attacker-influenced content to be reflected into the response body. Under certain browser behaviors, this MIME sniffing can lead to the response being interpreted as active HTML, which could enable script execution within the administrative interface.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject scripts that are executed in the context of the user's session on the affected device.