Is there a public PoC exploit available for CVE-2026-5841?

Yes, a public proof-of-concept exploit is available for CVE-2026-5841. Prioritise patching immediately. EPSS: 0.1%.

Tenda CVE-2026-5841

Q: What is the CVSS score of CVE-2026-5841?

CVE-2026-5841 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20850 MEDIUM

Path Traversal (CWE-22)

2026-04-09 VulDB

GHSA-jm2v-6xpj-h8v4

Path Traversal Tenda

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 05:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:15 euvd

EUVD-2026-20850

Analysis Generated

Apr 09, 2026 - 05:15 vuln.today

CVE Published

Apr 09, 2026 - 04:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Path traversal vulnerability in Tenda i3 router firmware version 1.0.0.6(2204) allows unauthenticated remote attackers to access arbitrary files via manipulation of the R7WebsSecurityHandler HTTP handler component. The vulnerability has a CVSS score of 6.9 (low confidentiality and integrity impact), publicly available exploit code exists, and exploitation requires only network access with no user interaction.

Technical ContextAI

The vulnerability resides in the HTTP request handler R7WebsSecurityHandler within the Tenda i3 router's web interface (CPE: cpe:2.3:a:tenda:i3:*:*:*:*:*:*:*:*). The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, Path Traversal), which occurs when user-supplied input is not properly validated before being used in file path operations. Attackers can craft HTTP requests containing path traversal sequences (such as '../' or absolute paths) that bypass intended directory restrictions, allowing access to sensitive files outside the web root directory. The lack of input sanitization in the handler permits manipulation of file paths without authentication.

RemediationAI

Users should immediately upgrade their Tenda i3 router firmware to the latest available version released by Tenda after 1.0.0.6(2204). Consult the official Tenda support website (https://www.tenda.com.cn/) for the latest firmware release and upgrade instructions specific to the i3 model. If a firmware update is not yet available, restrict network access to the router's web interface using firewall rules or network segmentation to block untrusted external access on HTTP/HTTPS ports (typically 80/443 and 8080/8443). Disable remote management features if not required, and ensure the router is isolated from untrusted networks pending patch availability. Verify the patched firmware version after upgrade by checking the router's system information page.