Tenda i9 CVE-2026-7036

Remote exploitation against default configurations of Tenda i9 routers with web management interface enabled and accessible. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions are required - attackers need only network connectivity to the router's HTTP/HTTPS management ports. However, exploitation is limited by network exposure: routers with management interfaces bound only to internal LAN addresses (not WAN-facing) significantly reduce attack surface to local network threats. Routers behind NAT without port forwarding rules exposing the web interface are protected from internet-based exploitation but remain vulnerable to attacks from compromised devices on the same local network. No specific feature enablement, non-default configuration, or user interaction is required beyond the web management service being active, which is the default state for Tenda i9 routers.

Real-world risk is HIGH despite the moderate 7.3 CVSS v3.1 score. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation requiring no authentication, no user interaction, and low complexity - meeting all criteria for automated mass exploitation. The publicly available exploit code on GitHub significantly lowers the barrier to entry for threat actors. The temporal modifier E:P confirms proof-of-concept existence, while RL:X indicates remediation level is currently unavailable or unconfirmed. EPSS data was not provided but would likely score moderately given the combination of remote unauthenticated access and public POC. The CVSS impact ratings (C:L/I:L/A:L) suggest limited but multi-faceted impact: attackers can read sensitive configuration files (credentials, network topology), modify settings, or cause denial of service. However, this assessment is conservative - path traversal in embedded device web interfaces often enables full administrative compromise through credential extraction or configuration tampering. The unchanged scope (S:U) limits blast radius to the vulnerable router itself. Critical missing data: no CISA KEV listing suggests this is not yet observed in widespread campaigns, and no vendor patch information is available from Tenda, leaving users without official remediation. The temporal rating RC:R (reasonable confidence) indicates the analysis is based on reliable but incomplete information.

An unauthenticated attacker scans internet-facing IP ranges for Tenda i9 routers exposing their web management interface on standard ports (typically TCP 80/443). Using the publicly available exploit code from GitHub (Litengzheng/vuldb_new), the attacker sends crafted HTTP requests to the R7WebsSecurityHandlerfunction with path traversal sequences to read /etc/shadow or router configuration files containing Wi-Fi credentials, ISP account details, and administrative passwords. The attacker then uses extracted credentials to establish persistent access, modify DNS settings to redirect traffic through malicious servers, or incorporate the router into a botnet for DDoS attacks.