A vulnerability has been identified in Tenda i12 firmware version 1.0.0.11 (build 3862) that allows an attacker to perform a path traversal through the HTTP Handler component. By sending a crafted HTTP request, a remote attacker can instruct the device to read or write files outside the intended directory, potentially exposing sensitive configuration files or enabling the upload of malicious code. This falls under the CWE‑22 weakness category. The impact is the ability for an attacker to read confidential data or execute unauthorized code on the device.

The affected product is Tenda i12, specifically firmware version 1.0.0.11 (build 3862). Only devices running this exact firmware build are known to be vulnerable; newer firmware releases may have addressed the flaw.

The CVSS score of 6.9 indicates a medium severity vulnerability. The exploit is accessible over the network and has been publicly disclosed, meaning that a remote adversary can exploit this flaw without needing local access. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the nature of the attack vector and the existence of public proof‑of‑concept code elevate the risk for exposed devices. Organizations should treat the exposure as a potentially serious threat if the target device is reachable from the internet or an untrusted network.