A path traversal flaw exists in the R7WebsSecurityHandler component of Tenda i3’s HTTP handler. Unauthenticated attackers can send crafted HTTP requests that manipulate the path parameter, causing the device to resolve the path outside the intended directory. This CWE‑22 weakness enables remote read access to critical configuration files, logs, or other sensitive data, potentially compromising confidentiality and integrity of the device’s system files.

The vulnerability impacts Tenda i3 routers running firmware version 1.0.0.6(2204). No other vendors or product versions are reported to be affected.

The CVSS score of 6.9 indicates medium severity, and the description confirms the attack can be performed remotely via the web interface. Exploit code has been made publicly available, implying that the flaw is actively used by attackers. Although EPSS data is not provided and the flaw is not listed in KEV, the presence of public exploits demonstrates a non‑negligible risk for devices exposed to the Internet.