EUVD-2026-20850
GHSA-jm2v-6xpj-h8v4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents moderate real-world risk despite the moderate CVSS score. The CVSS vector confirms unauthenticated remote access (AV:N, PR:N, AC:L) with low complexity attack requirements, making exploitation straightforward. The presence of publicly available exploit code significantly increases practical risk, as attackers do not need advanced capability development. However, the impact scope is restricted to low confidentiality and integrity impact (VC:L, VI:L, VA:L with SC:N, SI:N, SA:N), indicating the vulnerability does not achieve system-level compromise or denial of service. The EPSS score of 'P' signals predictable exploitation likelihood. This is a genuine priority for Tenda i3 users due to ease of exploitation and public proof-of-concept availability, but the limited impact scope (file disclosure rather than code execution or system takeover) prevents it from being critical. Organizations should treat this as a high-priority patch candidate, particularly if routers are internet-exposed. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet crafts an HTTP GET or POST request to the Tenda i3 router's web interface, embedding path traversal sequences (e.g., '../../etc/passwd' or '%2e%2e/sensitive_config') in the parameters processed by R7WebsSecurityHandler. The unvalidated input allows the HTTP handler to access files outside the intended web directory, such as configuration files containing credentials, system information, or firmware details. The attacker exfiltrates sensitive data without authentication or user interaction. Publicly available proof-of-concept code from the referenced GitHub repository (https://github.com/MrXiaoFan/TendaVul/) demonstrates this exploitation path, lowering the barrier to entry for malicious actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Path traversal vulnerability in Tenda i3 router firmware version 1.0.0.6(2204) allows unauthenticated remote attackers to access arbitrary files via manipulation of the R7WebsSecurityHandler HTTP handler component. The vulnerability has a CVSS score of 6.9 (low confidentiality and integrity impact), publicly available exploit code exists, and exploitation requires only network access with no user interaction.
RemediationAI
Users should immediately upgrade their Tenda i3 router firmware to the latest available version released by Tenda after 1.0.0.6(2204). Consult the official Tenda support website (https://www.tenda.com.cn/) for the latest firmware release and upgrade instructions specific to the i3 model. If a firmware update is not yet available, restrict network access to the router's web interface using firewall rules or network segmentation to block untrusted external access on HTTP/HTTPS ports (typically 80/443 and 8080/8443). Disable remote management features if not required, and ensure the router is isolated from untrusted networks pending patch availability. Verify the patched firmware version after upgrade by checking the router's system information page.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the HTTP request handler R7WebsSecurityHandler within the Tenda i3 router's web interface (CPE: cpe:2.3:a:tenda:i3:*:*:*:*:*:*:*:*). The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, Path Traversal), which occurs when user-supplied input is not properly validated before being used in file path operations. Attackers can craft HTTP requests containing path traversal sequences (such as '../' or absolute paths) that bypass intended directory restrictions, allowing access to sensitive files outside the web root directory. The lack of input sanitization in the handler permits manipulation of file paths without authentication.
Know when I3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB