PatchSiren cyber security CVE debrief

CVE-2026-6024 Tenda CVE debrief

A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vulnerability affects Tenda i6 devices with firmware version 1.0.0.7(2204) and is caused by a path traversal issue in the R7WebsSecurityHandlerfunction of the HTTP Handler component. Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component for potential path traversal vulnerabilities.

Vendor: Tenda
Product: i6
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-10
Original CVE updated: 2026-10-26
Advisory published: 2026-04-10
Advisory updated: 2026-10-26

Who should care

Defenders responsible for Tenda i6 devices with firmware version 1.0.0.7(2204) should assess exposure and prioritize verification of the HTTP Handler component. Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component for potential path traversal vulnerabilities.

Why it matters

Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component for potential path traversal vulnerabilities.

Verify exposure of Tenda i6 devices with firmware version 1.0.0.7(2204)
Assess the HTTP Handler component for potential path traversal vulnerabilities
Monitor for publicly disclosed exploits

Technical summary

The vulnerability affects Tenda i6 devices with firmware version 1.0.0.7(2204) and is caused by a path traversal issue in the R7WebsSecurityHandlerfunction of the HTTP Handler component. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component for potential path traversal vulnerabilities.

Defensive priority

Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component for potential path traversal vulnerabilities.

Recommended defensive actions

Verify exposure of Tenda i6 devices with firmware version 1.0.0.7(2204)
Assess the HTTP Handler component for potential path traversal vulnerabilities
Monitor for publicly disclosed exploits
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected product. The vulnerability affects Tenda i6 devices with firmware version 1.0.0.7(2204) and is caused by a path traversal issue in the R7WebsSecurityHandlerfunction of the HTTP Handler component. The exploit has been publicly disclosed and may be utilized. Defenders should prioritize verifying exposure of Tenda i6 devices with firmware version 1.0.0.7(2204) and assessing the HTTP Handler component.

Sources and references

Verified primary and authoritative sources

CVE-2026-6024 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-6024

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-6024 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6024

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_84/README.md

[email protected] - Exploit, Third Party Advisory
Source reference
Unverified legacy reference

URL: https://vuldb.com/submit/791826

[email protected] - Third Party Advisory, VDB Entry
Source reference
Unverified legacy reference

URL: https://vuldb.com/vuln/356600

[email protected] - Third Party Advisory, VDB Entry
Source reference
Unverified legacy reference

URL: https://vuldb.com/vuln/356600/cti

[email protected] - Permissions Required, VDB Entry
Source reference
Unverified legacy reference

URL: https://www.tenda.com.cn/

[email protected] - Product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.