CVE-2026-6024
Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Apr 10, 2026
- Updated
- Apr 10, 2026
- Reserved
- Apr 9, 2026
Description
A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
i6Tenda |
|
References
- VDB-356600 | Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversalvdb-entrytechnical-description
- VDB-356600 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #791826 | Tenda i6 V1.0.0.7(2204) Path Traversalthird-party-advisory
- https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_84/README.mdexploit
- https://www.tenda.com.cn/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.