Tenda F3 Wireless Router Sensitive Information Exposure Vulnerability

A vulnerability allowing the exposure of sensitive information has been identified in the Tenda F3 wireless router, specifically in firmware version 12.01.01.55_multi. This vulnerability arises from the configuration download feature, which inadvertently includes the router password and administrative password in plaintext. Additionally, the endpoint fails to implement proper Cache-Control directives, potentially allowing the response to be stored in client-side caches and accessed by other local users or processes with permission to view cached browser data.

Impact

The vulnerability could lead to unauthorized access to the router's administrative functions by exposing plaintext credentials that could be intercepted and misused.