The vulnerability identified as CVE-2026-5849 affects Tenda i12 firmware version 1.0.0.11(3862). It involves a path traversal issue in an unspecified function of the HTTP Handler component. An attacker can remotely exploit this flaw without authentication to access files beyond the web server's root directory. The vulnerability has been publicly disclosed, but there is no information on an official fix or patch from the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the device remotely without authentication. This may lead to unauthorized disclosure of sensitive information stored on the device. However, the impact on integrity and availability is limited according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote HTTP access where possible may reduce exposure.