CVE-2026-5841: Path Traversal in Tenda i3 Router

The path traversal vulnerability in the Tenda i3 router presents a significant security risk. An attacker can exploit this flaw to read arbitrary files from the router's file system. This could include configuration files containing passwords, SSH keys, or other sensitive credentials. Furthermore, depending on the router's configuration and file permissions, an attacker might be able to modify critical system files, leading to a complete compromise of the device. The remote nature of the exploit means an attacker does not need physical access to the router, only network connectivity. Given the widespread use of routers as entry points into home and small business networks, a successful attack could provide a foothold for lateral movement and further compromise of the internal network.

1. Reserved2026-04-08
2. Published2026-04-09
3. EPSS updated2026-04-16

Currently, Tenda has not released a patch for CVE-2026-5841. Until a firmware update is available, several mitigation strategies can be employed. First, restrict network access to the router's web interface using a firewall, allowing only trusted IP addresses to connect. Consider implementing a Web Application Firewall (WAF) or reverse proxy with strict access controls to filter potentially malicious requests targeting the R7WebsSecurityHandler. Regularly monitor router logs for suspicious activity, such as unusual file access attempts. If possible, isolate the router on a separate VLAN to limit the impact of a potential compromise. After a firmware upgrade is released, confirm the vulnerability is resolved by attempting a path traversal attack and verifying that access is denied.