The vulnerability CVE-2026-6024 affects Tenda i6 firmware version 1.0.0.7(2204) in the R7WebsSecurityHandler function of the HTTP Handler component. It allows an unauthenticated remote attacker to perform path traversal attacks, potentially accessing unauthorized files or directories on the device. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no official patch or mitigation has been announced by Tenda.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read arbitrary files on the affected device by leveraging path traversal. This could lead to disclosure of sensitive information stored on the device. The impact is rated medium based on the CVSS score and the nature of the vulnerability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided by Tenda, users should monitor for vendor updates and avoid exposing the device's management interface to untrusted networks until a patch is available.