What is the CVSS score of EUVD-2026-20860?

EUVD-2026-20860 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-20860?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20860. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-20860?

Within 24 hours: Identify all Tenda i12 routers in your environment running firmware 1.0.0.11(3862) and isolate affected devices from critical network segments pending remediation. Within 7 days: Contact Tenda for available firmware updates or replacement device options; deploy network segmentation to restrict direct internet access to affected routers. Within 30 days: Replace or upgrade all Tenda i12 devices to patched firmware versions once available, or decommission devices if no vendor patch is released; implement intrusion detection signatures targeting path traversal patterns to these devices.

I12 EUVD-2026-20860

| CVE-2026-5849 MEDIUM

Path Traversal (CWE-22)

2026-04-09 VulDB

Path Traversal Tenda I12

5.5

CVSS 4.0 · Vendor: VulDB

View

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 7.3 with unauthenticated network access and low complexity creates significant exposure for Tenda i12 users. Path traversal via HTTP handler enables file system access, threatening confidentiality and integrity. Publicly available exploit code and proof-of-concept substantially increase real-world risk. Patch availability from vendor should be prioritized immediately.
Exploit ScenarioDerived	Attacker sends crafted HTTP request with path traversal payloads (e.g., `../../../etc/passwd`) to Tenda i12 HTTP handler. No authentication required. Publicly available POC enables straightforward exploitation to read sensitive files or modify configuration.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Path traversal in Tenda i12 router firmware 1.0.0.11(3862) allows unauthenticated remote attackers to read, modify, or delete arbitrary files via malicious HTTP requests to an unidentified handler component. The vulnerability enables unauthorized access to the filesystem with low integrity and confidentiality impact. Publicly available exploit code exists, increasing the likelihood of opportunistic attacks against exposed devices.

RemediationAI

No vendor-released patch identified at time of analysis. Tenda has not published security advisories or firmware updates addressing CVE-2026-5849 per vendor website review (https://www.tenda.com.cn/). Recommended immediate mitigations: (1) Disable remote HTTP/HTTPS administrative access and restrict management interface to trusted internal networks only; (2) Deploy network segmentation to isolate vulnerable devices from untrusted networks; (3) Monitor vendor advisory channels for firmware updates; (4) Consider device replacement if vendor discontinues support. Reference technical details at https://github.com/Litengzheng/vuldb_new/blob/main/i12/vul_110/README.md and VulDB entry https://vuldb.com/vuln/356375 for attack indicators.

Affected VersionsENISA

i12 1.0.0.11(3862)

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

HTTP Handler component fails to properly sanitize user-supplied path input (CWE-22), enabling directory traversal sequences (e.g., '../') to escape intended access boundaries. Network-accessible attack vector (AV:N) with no authentication requirement (PR:N) permits remote exploitation. Affects Tenda i12 wireless router firmware version 1.0.0.11(3862) specifically.

Know when I12 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

CVE Published

Apr 09, 2026 - 05:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive ViewAI

Why It Matters

CVE-2026-5849 is a critical path traversal vulnerability affecting Tenda i12 routers (firmware 1.0.0.11(3862)) that allows unauthenticated attackers to read, modify, or delete arbitrary files on affected devices. Organizations relying on these routers for network access face immediate risk of unauthorized data exfiltration, configuration tampering, and potential lateral movement into internal networks.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict WAN access to affected Tenda i12 routers via firewall rules; disable remote management features if supported; implement network segmentation to limit lateral movement from compromised routers; monitor for suspicious HTTP requests targeting file system paths; consider replacement with patched device models or alternative vendors pending Tenda advisory updates.

Threat Intelligence Overview

EPSS Score

0.1%

Top 75% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.