CVE-2026-5841
Published: 09 April 2026
Summary
CVE-2026-5841 is a medium-severity Path Traversal (CWE-22) vulnerability in Tenda I3 Firmware. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5841 is a path traversal vulnerability (CWE-22) affecting the Tenda i3 router on firmware version 1.0.0.6(2204). The flaw exists in the R7WebsSecurityHandler function of the HTTP Handler component, where manipulated inputs allow traversal outside intended directories.
The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), enabling remote exploitation without authentication, privileges, or user interaction. Attackers can execute the manipulation over the network to achieve low-level impacts on confidentiality, integrity, and availability, such as reading or modifying restricted files.
Advisories reference a public exploit on GitHub targeting R7WebsSecurityHandler authentication bypass issues in the affected firmware, along with VulDB entries detailing the vulnerability and CTI. The Tenda vendor website is listed, but no specific patches or mitigations are outlined in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20850
Vulnerability details
A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made…
more
available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in the unauthenticated HTTP Handler (R7WebsSecurityHandler) of a public-facing router web interface directly enables remote exploitation of the application without credentials or user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the path traversal flaw in the R7WebsSecurityHandler function of the Tenda i3 firmware.
Mandates validation of HTTP handler inputs to block path traversal sequences like '../' that enable access outside intended directories.
Enforces logical access controls to restrict unauthorized reading or modification of restricted files despite path traversal attempts.