Which versions of Tenda are affected by CVE-2026-5849?

CVE-2026-5849 is a critical path traversal vulnerability affecting Tenda i12 routers (firmware 1.0.0.11(3862)) that allows unauthenticated attackers to read, modify, or delete arbitrary files on…

Is there a public PoC exploit available for CVE-2026-5849?

Yes, a public proof-of-concept exploit is available for CVE-2026-5849. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5849?

Within 24 hours: Identify all Tenda i12 routers in your environment running firmware 1.0.0.11(3862) and isolate affected devices from critical network segments pending remediation. Within 7 days: Contact Tenda for available firmware updates or replacement device options; deploy network segmentation to restrict direct internet access to affected routers. Within 30 days: Replace or upgrade all Tenda i12 devices to patched firmware versions once available, or decommission devices if no vendor patch is released; implement intrusion detection signatures targeting path traversal patterns to these devices.

Tenda CVE-2026-5849

Q: What is the CVSS score of CVE-2026-5849?

CVE-2026-5849 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20860 MEDIUM

Path Traversal (CWE-22)

2026-04-09 VulDB

Path Traversal Tenda

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:45 euvd

EUVD-2026-20860

Analysis Generated

Apr 09, 2026 - 05:45 vuln.today

CVE Published

Apr 09, 2026 - 05:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Path traversal in Tenda i12 router firmware 1.0.0.11(3862) allows unauthenticated remote attackers to read, modify, or delete arbitrary files via malicious HTTP requests to an unidentified handler component. The vulnerability enables unauthorized access to the filesystem with low integrity and confidentiality impact. Publicly available exploit code exists, increasing the likelihood of opportunistic attacks against exposed devices.

Technical ContextAI

HTTP Handler component fails to properly sanitize user-supplied path input (CWE-22), enabling directory traversal sequences (e.g., '../') to escape intended access boundaries. Network-accessible attack vector (AV:N) with no authentication requirement (PR:N) permits remote exploitation. Affects Tenda i12 wireless router firmware version 1.0.0.11(3862) specifically.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published security advisories or firmware updates addressing CVE-2026-5849 per vendor website review (https://www.tenda.com.cn/). Recommended immediate mitigations: (1) Disable remote HTTP/HTTPS administrative access and restrict management interface to trusted internal networks only; (2) Deploy network segmentation to isolate vulnerable devices from untrusted networks; (3) Monitor vendor advisory channels for firmware updates; (4) Consider device replacement if vendor discontinues support. Reference technical details at https://github.com/Litengzheng/vuldb_new/blob/main/i12/vul_110/README.md and VulDB entry https://vuldb.com/vuln/356375 for attack indicators.