CVE-2026-5962: Path Traversal in Tenda CH22

The Path Traversal vulnerability in Tenda CH22 allows an attacker to bypass intended access restrictions and retrieve arbitrary files from the router's file system. This could include configuration files, system logs, or even user credentials stored on the device. Successful exploitation could lead to unauthorized access to the router's internal workings, potentially enabling further attacks such as command execution or data exfiltration. The public availability of an exploit significantly increases the risk of widespread exploitation.

1. Reserved2026-04-09
2. Published2026-04-09
3. EPSS updated2026-04-17

The primary mitigation for CVE-2026-5962 is to upgrade the Tenda CH22 firmware to a patched version as soon as it becomes available. Until the upgrade is possible, implement temporary mitigations such as configuring a Web Application Firewall (WAF) to filter requests containing path traversal sequences (e.g., '../'). Restrict access to the router's web interface from untrusted networks. Regularly monitor router logs for suspicious activity and unusual file access attempts.