CVE-2026-5841

Katalog CVE

CVSS 9.8 · Critical EPSS 0,78%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada tenda i3 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MrXiaoFan/TendaVul/tree/main/tenda-i3-V1.0.0.6(2204)-R7WebsSecurityHandler-Authentication%2... exploit · advisory pihak ketiga
• https://vuldb.com/submit/789935 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/356297 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/356297/cti permissions required · vdb entry
• https://www.tenda.com.cn/ product