The vulnerability CVE-2026-5841 involves a path traversal flaw in the R7WebsSecurityHandler function of the HTTP Handler component in Tenda i3 version 1.0.0.6(2204). This flaw allows remote attackers to manipulate file paths to access files outside the intended directory structure. The vulnerability requires no privileges or user interaction to exploit. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. Public exploit code is available, but no vendor patch or official remediation has been published.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the affected device remotely. This could lead to unauthorized disclosure of sensitive information stored on the device. There is no indication of privilege escalation or denial of service impact in the provided data. The medium severity score reflects moderate risk due to the ease of remote exploitation and potential information exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor Tenda's official channels for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote administration features, if possible, may reduce exposure.