The Tenda i6 device running firmware version 1.0.0.7(2204) contains a path traversal vulnerability in the R7WebsSecurityHandlerfunction of its HTTP Handler component. This flaw allows an unauthenticated remote attacker to manipulate file paths via crafted requests, potentially accessing files outside the intended directory structure. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. No vendor advisory or patch information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to read arbitrary files on the affected device, potentially exposing sensitive information. The vulnerability does not require privileges or user interaction and has low attack complexity. However, the overall impact is limited by the scope of accessible files and the device's role. There is no indication of code execution or privilege escalation from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the device's management interface to trusted networks only. Monitor vendor communications for updates regarding patches or mitigations.