CVE-2026-5962 is a high severity flaw (CVSS 7.3) in the Tenda CH22, firmware 1.0.0.6(468). The R7WebsSecurityHandlerfunction in the httpd component allows path traversal, and the record says the exploit is public. No fix is named, so check Tenda for firmware.
What's affected
- Tenda CH22 firmware 1.0.0.6(468).
- Fixed version: none named in the record.
How to check if you're exposed
Log in to the device and read the firmware version. If it matches 1.0.0.6(468), treat it as affected. Check whether the web management interface is reachable from the internet.
Firmware is outside what a code scan covers, but the Gold directory is a quick way to look up the CVE record and the weakness class when you write the change ticket.
What to do now
- Check the Tenda website for newer firmware.
- Disable remote management.
- Keep the admin interface on the local network only.
- Replace the device if no fix is released.
Keep a short list of every device of this model on your network, with its firmware version and where it sits. Embedded gear is easy to forget, and a list is what lets you act quickly when a vendor ships an update.
Why it matters
This is CWE-22 (Path Traversal). A request can reach files outside the path the handler intended. The record says an attack may be launched remotely and that the exploit is public. It does not say attacks were seen in the wild, and the CISA KEV flag is false.
A sibling record, CVE-2026-5841, affects the Tenda i3 with the same function name.
Router firmware for small business and home gear is often discontinued quietly. If the vendor site shows no update for your model, plan the replacement as a budget item rather than waiting.
Quick check
Is a fix available?
The record names none.
Sources
Last reviewed: 19 October 2026.
