CVE-2026-5962
Published: 09 April 2026
Description
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly patches the path traversal vulnerability in the R7WebsSecurityHandler function of the httpd component, preventing remote exploitation.
Information input validation rejects malicious path traversal payloads sent to the vulnerable web handler, blocking unauthorized file access.
Access enforcement mediates file access requests, limiting damage from successful path traversal by denying unauthorized reads or writes outside intended directories.
Security SummaryAI
CVE-2026-5962 is a path traversal vulnerability (CWE-22) in Tenda CH22 firmware version 1.0.0.6(468). The issue affects the R7WebsSecurityHandlerfunction within the httpd component, enabling manipulation that leads to unauthorized file access outside intended directories.
The vulnerability is exploitable remotely by unauthenticated attackers requiring low complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation grants limited impacts on confidentiality, integrity, and availability, such as reading or modifying restricted files.
Advisories and additional details are documented in VulDB entries (vuldb.com/vuln/356515 and related pages) and a GitHub repository containing a public exploit (github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_55/README.md). The Tenda website (tenda.com.cn) provides manufacturer resources, which security practitioners should review for patch availability or mitigation steps.
The exploit is public and may be used, posing elevated risk to unpatched Tenda CH22 devices exposed to the internet.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in public-facing httpd web interface enables unauthenticated remote exploitation of public-facing application for unauthorized file access.