CVE Intelligence
Analysis AI-assisted

CVE-2026-5962: Tenda CH22 httpd path traversal in R7WebsSecurityHandlerfunction

VulDB reported a path traversal weakness (CWE-22) in the R7WebsSecurityHandlerfunction of the httpd component of Tenda CH22 version 1.0.0.6, which the record says can be triggered remotely. NVD scores it 9.8 (critical) under CVSS 3.1, while the record states a public exploit exists and no confirmed active exploitation or fixed version is listed.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

VulDB reported a path traversal weakness (CWE-22) in the R7WebsSecurityHandlerfunction of the httpd component of Tenda CH22, version 1.0.0.6. The vulnerability is tracked in NVD and described in the VulDB entry.

Impact

  • The record states that the attack may be launched remotely.
  • NVD scores the issue 9.8 (critical) under CVSS 3.1 with high confidentiality, integrity and availability impact in the vector. Other providers score it lower, for example 7.3 under CVSS 3.1 from VulDB.
  • Path traversal weaknesses generally allow access to files outside the intended directory. The exact impact on this product has not been verified in the sources consulted.

Affected products and versions

  • Tenda CH22 and Tenda Ch22 Firmware, version 1.0.0.6 as listed in the record.
  • The record lists no fixed version.

Exploitation status

  • The record states that the exploit is public and may be used. A reference tagged as an exploit is listed in the record.
  • The record shows this CVE is not listed in the CISA KEV catalog, so no active exploitation in the wild is stated.
  • SSVC exploitation is recorded as proof of concept, and automatable as yes.
  • EPSS probability is recorded as 0.00782 with percentile 0.5554.

Remediation and mitigation

  • Identify whether Tenda CH22 devices run the affected version and check the vendor site for firmware updates. The record provides no fix.
  • Limit access to the management interface to trusted networks and disable remote administration where it is not required.
  • Apply compensating controls such as network segmentation and access restrictions until an official fix is confirmed.

Detection guidance

  • Review web management logs for unusual requests to the httpd service, especially requests with unexpected file path patterns.
  • Monitor devices for unexpected configuration or firmware changes and for administrative access from unknown sources.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory with details, and the vendor reference is only a homepage.
  • CVSS scores differ across providers; this analysis cites the NVD score of 9.8.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated as recorded and not independently verified.

Frequently asked questions

What is CVE-2026-5962?

It is a path traversal weakness (CWE-22) in the R7WebsSecurityHandlerfunction of the httpd component of Tenda CH22 version 1.0.0.6, according to the VulDB record.

Is this vulnerability being actively exploited?

The record does not list it in the CISA KEV catalog and does not confirm active exploitation. It does state that a public exploit exists and may be used.

Is there a fixed version?

The record lists no fixed version. Check the vendor for firmware updates and apply compensating controls in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.