Vulnerability · Published Apr 10, 2026 · Assigned by VulDB
CVE-2026-6024Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal
High 7.3
In plain English
A high-severity path traversal in i6 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-356600 | Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal vdb-entry, technical-description
- VDB-356600 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #791826 | Tenda i6 V1.0.0.7(2204) Path Traversal third-party-advisory
- https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_84/README.md exploit
- https://www.tenda.com.cn/ product