This vulnerability affects Tenda i9 firmware version 1.0.0.5(2204) in the HTTP Handler's R7WebsSecurityHandlerfunction. It allows an attacker to perform path traversal by manipulating input to this function, potentially accessing unauthorized files or directories on the device. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. Although a public exploit is available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation could allow an attacker to access files or directories outside the intended scope on the affected device, potentially leading to information disclosure or further compromise depending on the accessed data. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, no evidence of exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity. No official vendor mitigation or workaround has been provided.