Vulnerability · Published Apr 9, 2026 · Assigned by VulDB
CVE-2026-5841Tenda i3 HTTP R7WebsSecurityHandler path traversal
High 7.3
In plain English
A high-severity path traversal in i3 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-356297 | Tenda i3 HTTP R7WebsSecurityHandler path traversal vdb-entry, technical-description
- VDB-356297 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #789935 | Tenda i3 V1.0.0.6(2204) Authentication Bypass Issues third-party-advisory
- https://github.com/MrXiaoFan/TendaVul/tree/main/tenda-i3-V1.0.0.6(2204)-R7WebsSecurityHandler-Authentication%20Bypass%20Issues exploit
- https://www.tenda.com.cn/ product