CVE-2026-6024 Tenda i6 HTTP R7WebsSecurityHandlerfunction path traversal
Remote attackers can exploit a path traversal vulnerability in the Tenda i6 router's HTTP handler to access unauthorized files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6024?
CVE-2026-6024 is a medium-severity path traversal vulnerability in Tenda i6, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in Tenda i6 1.0.0.7(2204). Affected by this issue is the function R7WebsSecurityHandlerfunction of the component HTTP Handler. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Weakness: CWE-22
Which versions are affected by CVE-2026-6024?
It affects 1 product.
Products include Tenda I6 Firmware.
How do I fix CVE-2026-6024?
No fix has been published for CVE-2026-6024 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-6024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6024 exists.
Other vulnerabilities in Tenda i6
- CVE-2023-48963 Memory corruption in n/a
- CVE-2023-48964 Memory corruption in n/a
- CVE-2024-0990 Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow
- CVE-2024-0991 Tenda i6 httpd setcfm formSetCfm stack-based overflow
- CVE-2024-0992 Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow
Sources
Also known as GHSA-5v5f-c63q-mm7g.