CVE-2026-7036 is a high severity (CVSS 7.3) path traversal in the HTTP handler of the Tenda i9 router, firmware 1.0.0.5(2204). The record says a public exploit exists and names no fixed firmware. Keep the web interface off the internet and check Tenda for an update.
What's affected
The record lists the Tenda i9 and its firmware, version 1.0.0.5(2204). The weak spot is the function R7WebsSecurityHandler in the HTTP handler component. Other firmware versions are not named, so do not assume they are safe.
No fixed version is given in the record or in the write-up it links, and I could not read the VulDB pages, which block automated requests. Treat the device as unpatched until Tenda says otherwise.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the system status page. If it shows V1.0.0.5(2204), you are in scope.
Then check reachability. From a network outside your own, confirm the router's web interface does not answer on its WAN address. If remote management is on, turn it off. Internally, limit who can reach the admin page.
What to do now
- List every Tenda i9 you manage and its firmware version.
- Disable remote (WAN side) administration.
- Limit the admin interface to a management network or a few trusted hosts.
- Check the Tenda support site for newer firmware and apply it when it exists.
- If the device is internet facing and cannot be locked down, plan to replace it.
Why it matters
The weakness is CWE-22, path traversal. The linked write-up describes a gatekeeper function that lets some URL prefixes through without login, because it checks how a path begins but does not clean up the rest of it. That makes a request that starts with an allowed prefix look harmless while pointing somewhere else.
Router flaws matter because the device sits in front of everything else on the network. The record states a public exploit is available. It does not say the flaw is being used in attacks, and the KEV flag is false.
Quick check
Is there a patch for CVE-2026-7036?
I could not confirm one. The record names no fixed firmware, so check the vendor site and apply mitigations in the meantime.
Sources
Last reviewed: 19 October 2026.
