CVE-2026-5841 is a high severity flaw (CVSS 7.3) in the Tenda i3, firmware 1.0.0.6(2204). The R7WebsSecurityHandler function in the HTTP handler allows path traversal, and the record says a public exploit exists. No fix is named, so check Tenda for firmware.
What's affected
- Tenda i3 firmware 1.0.0.6(2204).
- Fixed version: none named in the record.
How to check if you're exposed
Log in to the device and read the firmware version on the status page. If it matches 1.0.0.6(2204), treat it as affected. Then check whether the web management interface is reachable from the internet.
Firmware is outside what a code scan covers, but the Gold directory is a quick way to look up the CVE record and the weakness class when you write the change ticket.
What to do now
- Check the Tenda website for newer firmware.
- Disable remote management and keep the admin interface on the local network only.
- Segment the device from sensitive systems.
- Replace the device if no fix is released.
Keep a short list of every device of this model on your network, with its firmware version and where it sits. Embedded gear is easy to forget, and a list is what lets you act quickly when a vendor ships an update.
Why it matters
This is CWE-22 (Path Traversal). A request can reach files outside the path the handler intended. The record says the attack can be launched remotely and that an exploit has been published. It does not say attacks have been seen in the wild, and the CISA KEV flag is false.
Consumer routers rarely get automatic updates, which makes exposure last.
The record points to a public write-up and a VulDB entry. Neither is a vendor fix, and the record names no patched firmware. Plan for the case where no update comes.
Quick check
Is a fix available?
The record names none. Check the vendor site.
Sources
Last reviewed: 19 October 2026.
