CVE-2026-6024: Path Traversal in Tenda i6

Successful exploitation of CVE-2026-6024 allows an attacker to bypass access controls and read arbitrary files on the Tenda i6 router. This could include configuration files, firmware images, or other sensitive data. Depending on the contents of these files, an attacker could gain valuable information about the network, potentially leading to further attacks. While the description doesn't specify direct command execution, the ability to read configuration files could reveal credentials or other information that could be used to compromise the device or the network it's connected to. The public disclosure of this vulnerability significantly increases the likelihood of exploitation attempts.

1. Reserved2026-04-09
2. Published2026-04-10
3. EPSS updated2026-04-17

The primary mitigation for CVE-2026-6024 is to upgrade the Tenda i6 router to a patched firmware version. Unfortunately, a specific fixed version is not provided in the CVE details. Until a patch is available, consider implementing temporary workarounds such as restricting network access to the router using a firewall, and disabling any unnecessary services or features. Monitor router logs for suspicious activity, particularly attempts to access unusual file paths. After applying any available firmware update, verify the fix by attempting to access a restricted file via the vulnerable endpoint and confirming that access is denied.