This vulnerability involves a path traversal issue in the R7WebsSecurityHandler function of the httpd component on Tenda CH22 version 1.0.0.6(468). An attacker can remotely manipulate file paths, potentially accessing unauthorized files on the device. The CVSS 4.0 vector indicates network attack vector with low complexity and no privileges or user interaction required. The vulnerability is publicly known but lacks an official fix or mitigation from the vendor.

Successful exploitation could allow an unauthenticated remote attacker to access files outside the intended directory structure on the affected device. This may lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided mitigations or workarounds are currently documented.