CVE-2026-7036
Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Apr 26, 2026
- Updated
- Apr 27, 2026
- Reserved
- Apr 25, 2026
Description
A vulnerability was identified in Tenda i9 1.0.0.5(2204). This vulnerability affects the function R7WebsSecurityHandlerfunction of the component HTTP Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
i9Tenda |
|
References
- VDB-359616 | Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversalvdb-entrytechnical-description
- VDB-359616 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #798479 | Tenda i9 V1.0.0.5(2204) Absolute Path Traversalthird-party-advisory
- https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_80/README.mdexploit
- https://www.tenda.com.cn/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.