Vulnerability · Published Apr 9, 2026 · Assigned by VulDB
CVE-2026-5962Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal
High 7.3
In plain English
A high-severity path traversal in CH22 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-356515 | Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal vdb-entry, technical-description
- VDB-356515 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #791277 | Tenda CH22 V1.0.0.6(468) Path Traversal third-party-advisory
- https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_55/README.md exploit
- https://www.tenda.com.cn/ product