This vulnerability involves a path traversal weakness in the R7WebsSecurityHandler function of the HTTP Handler component in Tenda i3 version 1.0.0.6(2204). An attacker can remotely manipulate the function to traverse directories outside the intended scope, potentially accessing unauthorized files. The vulnerability requires no privileges or user interaction to exploit and has a medium impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no vendor patch or official remediation has been disclosed yet.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to access files outside the intended directory structure on the affected device. This could lead to unauthorized disclosure of sensitive information or modification of files, impacting confidentiality and integrity. The vulnerability does not require user interaction or privileges, increasing its risk. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected device's management interface to trusted hosts only and monitor for any unusual activity. Avoid exposing the device's HTTP management interface directly to untrusted networks.