Which versions of Tenda are affected by EUVD-2026-20860?

CVE-2026-5849 is a critical path traversal vulnerability affecting Tenda i12 routers (firmware 1.0.0.11(3862)) that allows unauthenticated attackers to read, modify, or delete arbitrary files on…

Is there a public PoC exploit available for EUVD-2026-20860?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20860. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-20860?

Within 24 hours: Identify all Tenda i12 routers in your environment running firmware 1.0.0.11(3862) and isolate affected devices from critical network segments pending remediation. Within 7 days: Contact Tenda for available firmware updates or replacement device options; deploy network segmentation to restrict direct internet access to affected routers. Within 30 days: Replace or upgrade all Tenda i12 devices to patched firmware versions once available, or decommission devices if no vendor patch is released; implement intrusion detection signatures targeting path traversal patterns to these devices.

Tenda EUVD-2026-20860

Q: What is the CVSS score of EUVD-2026-20860?

EUVD-2026-20860 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5849 MEDIUM

Path Traversal (CWE-22)

2026-04-09 VulDB

Tenda Path Traversal

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:45 euvd

EUVD-2026-20860

Analysis Generated

Apr 09, 2026 - 05:45 vuln.today

CVE Published

Apr 09, 2026 - 05:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Path traversal in Tenda i12 router firmware 1.0.0.11(3862) allows unauthenticated remote attackers to read, modify, or delete arbitrary files via malicious HTTP requests to an unidentified handler component. The vulnerability enables unauthorized access to the filesystem with low integrity and confidentiality impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	CVSS 7.3 with unauthenticated network access and low complexity creates significant exposure for Tenda i12 users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Attacker sends crafted HTTP request with path traversal payloads (e.g., `../../../etc/passwd`) to Tenda i12 HTTP handler. No authentication required. …
Remediation	No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Tenda i12 routers in your environment running firmware 1.0.0.11(3862) and isolate affected devices from critical network segments pending remediation. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-38065 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the

CVE-2026-38060 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin p

CVE-2026-38061 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volum

CVE-2026-38062 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the rat

CVE-2026-38063 CRITICAL Act Now

9.8 Jun 15

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via

EUVD-2026-20860 vulnerability details – vuln.today

Back

Tenda EUVD-2026-20860

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code